d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2308ce690cdcc2a.bin.exe
Size 14.3MB
Sample260928-e17qpavs3p
SHA256 d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3
MD5 bac9ba849e5f0de203e9c11363c15676
SHA1 72a663a9bb8da8505ab154401fba9e64347dcb52
SHA512 9b4a34f179fa42342f4497c3bce3c3d218a71904df877497f4dc6af6b1f3ba54d9d259502318b37abd9fe0083b42e41181140d8b6aa5bc9dd0743b6cab82c7b0
SSDEEP 393216:bgtsDjfCwjdVcC6IkI1Jy7Yukl4er794USdwZjffoOKQ:bmsDjHAIkMJy7der+US4fog
TLSH
T160E633E16AF16427ED87B4B4D40482613A504AB8437676C8A194E6AF4C3D60BCD3DFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2380	gupdater.exe
4396	gupdater.exe
4512	gupdater.exe
5164	crashpad_handler.exe
464	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4512	gupdater.exe
4512	gupdater.exe
4512	gupdater.exe
4512	gupdater.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe
5164	crashpad_handler.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5452 wrote to memory of 2380	5452	d2308ce690cdcc2a.bin.exe	90
PID 2380 wrote to memory of 1484	2380	gupdater.exe	91
PID 4512 wrote to memory of 5164	4512	gupdater.exe	97
PID 4512 wrote to memory of 464	4512	gupdater.exe	99
PID 5164 wrote to memory of 6100	5164	crashpad_handler.exe	100
PID 5164 wrote to memory of 1960	5164	crashpad_handler.exe	101
PID 5164 wrote to memory of 5868	5164	crashpad_handler.exe	102
PID 5164 wrote to memory of 3304	5164	crashpad_handler.exe	103
PID 5164 wrote to memory of 1856	5164	crashpad_handler.exe	104
PID 5164 wrote to memory of 3464	5164	crashpad_handler.exe	105
PID 5164 wrote to memory of 936	5164	crashpad_handler.exe	106
PID 5164 wrote to memory of 424	5164	crashpad_handler.exe	107
PID 5164 wrote to memory of 1076	5164	crashpad_handler.exe	108
PID 5164 wrote to memory of 2744	5164	crashpad_handler.exe	109
PID 5164 wrote to memory of 2080	5164	crashpad_handler.exe	110
PID 5164 wrote to memory of 3664	5164	crashpad_handler.exe	111
PID 5164 wrote to memory of 5276	5164	crashpad_handler.exe	112
PID 5164 wrote to memory of 2140	5164	crashpad_handler.exe	113
PID 5164 wrote to memory of 1860	5164	crashpad_handler.exe	114
PID 5164 wrote to memory of 3572	5164	crashpad_handler.exe	115
PID 5164 wrote to memory of 1512	5164	crashpad_handler.exe	116
PID 5164 wrote to memory of 1032	5164	crashpad_handler.exe	117
PID 5164 wrote to memory of 2848	5164	crashpad_handler.exe	118
PID 5164 wrote to memory of 5412	5164	crashpad_handler.exe	119
PID 5164 wrote to memory of 1504	5164	crashpad_handler.exe	120
PID 5164 wrote to memory of 2788	5164	crashpad_handler.exe	121
PID 5164 wrote to memory of 4816	5164	crashpad_handler.exe	122
PID 5164 wrote to memory of 4280	5164	crashpad_handler.exe	123
PID 5164 wrote to memory of 1460	5164	crashpad_handler.exe	124
PID 5164 wrote to memory of 3988	5164	crashpad_handler.exe	125
PID 5164 wrote to memory of 6072	5164	crashpad_handler.exe	126
PID 5164 wrote to memory of 4172	5164	crashpad_handler.exe	127
PID 5164 wrote to memory of 3196	5164	crashpad_handler.exe	128
PID 5164 wrote to memory of 2212	5164	crashpad_handler.exe	129
PID 5164 wrote to memory of 3616	5164	crashpad_handler.exe	130

C:\Users\Admin\AppData\Local\Temp\d2308ce690cdcc2a.bin.exe
"C:\Users\Admin\AppData\Local\Temp\d2308ce690cdcc2a.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5452
- C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
  "C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /install2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SYSTEM32\certutil.exe
    certutil -addstore Root "C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer"
    3⤵
    PID:1484

C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
"C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /svc
1⤵
- Executes dropped EXE
PID:4396

C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
"C:\ProgramData\Google\Update\pshkiugu\gupdater.exe" /svc
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512
- C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe
  "C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:6100
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1960
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5868
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3304
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1856
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3464
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:936
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:424
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1076
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2744
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2080
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3664
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5276
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2140
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1860
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3572
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1512
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1032
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2848
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:5412
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1504
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2788
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4816
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4280
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:1460
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3988
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:6072
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:4172
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3196
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:2212
- - C:\Windows\system32\conhost.exe
    "C:\Windows\system32\conhost.exe"
    3⤵
    PID:3616
- C:\ProgramData\Google\Update\pshkiugu\chrome.exe
  "C:\ProgramData\Google\Update\pshkiugu\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.CSNFRHEA
  2⤵
  - Executes dropped EXE
  PID:464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.dll

Path C:\ProgramData\Google\Update\pshkiugu\chrome.dll
Size 78KB
SHA256 777b50d4b27e43e5754e18da6445a891780f1527232a7ddc0ba73dccd8566041
MD5 3ff7da5d52bcfc8166a2eea8520ce993
SHA1 962fd3be07bd2d83599a17f010d8bb21f6132a9d
SHA512 998f2c2382cd68b17807ab67615bcd683c9d64c9fe579eefd2dce0634da936ac71ff914bbde4de095659d12e2e27050b13bbd45150e1af1ade5eaa47d1225430
SSDEEP 1536:TxjntGqLjyUakywcHA66L3DvAuK8Eu5n3kp+kO9ihAp8nJHa9KiZOpoRA:TRtZ/y1Dxu/NK8Eut2+kSCAiziZTi
TLSH
T1C873F18E32C6987FC09FC4BC91DB8A30A9B0B5453D3D3F2DC524C253586D899A7A8C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\ProgramData\Google\Update\pshkiugu\chrome.exe
Size 112KB
SHA256 57a762a8599a2ef02b1d70870ad3a6e8a69d39efd63b4180ff7f417cac44c9c5
MD5 e8cc7998f82b4404c03cabd28b98715f
SHA1 e08ee89b20bd71ea21c5930cb8b357ab605428a8
SHA512 23741723b45b541f7354f835d8ba896bc6bafaed2ee38bb420504f984bbf28e988872f5d4980d3c4d1d7545f3f943742c1f97526841b5349b686a756d5ef009b
SSDEEP 3072:kHrIfsDDUz7g+hUmFULwixPhyIoOI4omwZdwg:0IfICazDDs6
TLSH
T1CCB35B0BF29360FCC28BC234959796B1FA717C2506356F3FA990E6353D31E106A5DE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\ProgramData\Google\Update\pshkiugu\crashpad_handler.exe
Size 99KB
SHA256 4b314e71b5f2d3ff47d493c578792738cea0cbedf1ba209669c14abb99644585
MD5 0c0dc6bebca0f5fe2341750e8abc0ba2
SHA1 9d7090ed27c0d06674e3c287ae713cc2296a722b
SHA512 50e4db68e11b907b418e755ed5791c6fd104c3afc1aed7eaf95fef52e1ba554453a2a6d605d7cb6f2cbf8c660b0ea09e444a807cf3cae6d8fb3196c85f29d389
SSDEEP 1536:cMeIydPURCheGx02zyLDg2SIbP6/HBOTFTfo5OEjleomwjVDBX07:cM1ohzGg2NP6Pi9o8E4omw5D107
TLSH
T10DA31947F29364ECC257C13491979672FB31BC750535AF7FAAA0CA752D20D20AE2CE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gupdater.exe

Path C:\ProgramData\Google\Update\pshkiugu\gupdater.exe
Size 14.3MB
SHA256 d2308ce690cdcc2a36398b46275c093afb4cfb8360324516f331cde41b5280e3
MD5 bac9ba849e5f0de203e9c11363c15676
SHA1 72a663a9bb8da8505ab154401fba9e64347dcb52
SHA512 9b4a34f179fa42342f4497c3bce3c3d218a71904df877497f4dc6af6b1f3ba54d9d259502318b37abd9fe0083b42e41181140d8b6aa5bc9dd0743b6cab82c7b0
SSDEEP 393216:bgtsDjfCwjdVcC6IkI1Jy7Yukl4er794USdwZjffoOKQ:bmsDjHAIkMJy7der+US4fog
TLSH
T160E633E16AF16427ED87B4B4D40482613A504AB8437676C8A194E6AF4C3D60BCD3DFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucert_tmp.cer

Path C:\Users\Admin\AppData\Local\Temp\gucert_tmp.cer
Size 758B
SHA256 2dce8b2484fb7437c17af890b479988fac2ce5b8dff4823f2b0b2d3f8e5ea313
MD5 999ef191647c4a0dff52548a3f35522a
SHA1 2095e4d0a9993b635026d55f5dfe5eec12ae533b
SHA512 6f8c02b125f359f3328706c0a448378cb2215512a3441f60603f76c7477e6bac9415cdecfe68d1b5c579cbb156237c6d73d7c8dd430536cc9555975de9b4845a
TLSH
T1B801206E7F623112BE4A2C115AC9D3377DB4DE95B821BCC6322245E9EE212F14E0681C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/464-56-0x00007FF6A8FC0000-0x00007FF6A8FE5000-memory.dmp

Download

memory/2380-6-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/2380-9-0x00007FF7854A0000-0x00007FF7854B4000-memory.dmp

Download

memory/2380-37-0x00007FF7854A0000-0x00007FF7854B4000-memory.dmp

Download

memory/2380-35-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4396-40-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4396-30-0x00007FF7854A0000-0x00007FF7854B4000-memory.dmp

Download

memory/4396-29-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4512-42-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4512-36-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/4512-41-0x00007FF7854A0000-0x00007FF7854B4000-memory.dmp

Download

memory/5164-58-0x00007FF7586B0000-0x00007FF7586D1000-memory.dmp

Download

memory/5164-60-0x00007FF7586B0000-0x00007FF7586D1000-memory.dmp

Download

memory/5452-39-0x00007FF7B0B20000-0x00007FF7B0B34000-memory.dmp

Download

memory/5452-38-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/5452-0-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/5452-8-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/5452-7-0x00007FF7B0B20000-0x00007FF7B0B34000-memory.dmp

Download

memory/5452-2-0x0000000140000000-0x0000000140E42000-memory.dmp

Download

memory/5452-1-0x0000000140000000-0x0000000140E42000-memory.dmp

Download