Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
28/09/2026, 12:26
General
- Target Chrome.exe
- Size 14.6MB
- Sample260928-pma5nstdma
- SHA256 fd489eaf44af60a8bd0c45f0a35f8cc0dfc5ceb1636f12c13d9cf9d7f65360e3
Malware Config
Signatures
- Executes dropped EXE 24 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Chrome.exe"C:\Users\Admin\AppData\Local\Temp\Chrome.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\2htsm2zn\googleupdater.exe"C:\ProgramData\Google\Update\2htsm2zn\googleupdater.exe" /install22⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\2htsm2zn\crashpad_handler.exe"C:\ProgramData\Google\Update\2htsm2zn\crashpad_handler.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\2htsm2zn\chrome.exe"C:\ProgramData\Google\Update\2htsm2zn\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.VHVQVSII4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" -L5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=name,driver_version --format=csv,noheader5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=pci.bus_id --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=memory.total --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=power.limit,power.default_limit --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=temperature.gpu,clocks.sm,clocks.mem,fan.speed,power.draw,power.draw.instant --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
-
-
C:\ProgramData\Google\Update\2htsm2zn\chrome.exe"C:\ProgramData\Google\Update\2htsm2zn\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.VHVQVSII3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" -L4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=name,driver_version --format=csv,noheader4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=pci.bus_id --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=memory.total --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=power.limit,power.default_limit --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=temperature.gpu,clocks.sm,clocks.mem,fan.speed,power.draw,power.draw.instant --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
-
-
C:\ProgramData\Google\Update\2htsm2zn\googleupdater.exe"C:\ProgramData\Google\Update\2htsm2zn\googleupdater.exe" /run1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\2htsm2zn\chrome.exe"C:\ProgramData\Google\Update\2htsm2zn\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.VHVQVSII2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" -L3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=name,driver_version --format=csv,noheader3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=pci.bus_id --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=memory.total --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=power.limit,power.default_limit --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\2htsm2zn\nvidia-smi.exe"nvidia-smi" --query-gpu=temperature.gpu,clocks.sm,clocks.mem,fan.speed,power.draw,power.draw.instant --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome.dll
chrome.exe
crashpad_handler.exe
googleupdater.exe
nvidia-smi.exe
memory/220-101-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/900-164-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-168-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-114-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-161-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-170-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-126-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-123-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-120-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-71-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-111-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/900-117-0x00007FF654520000-0x00007FF654541000-memory.dmp
memory/924-89-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/1072-136-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/1156-83-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/1468-0-0x0000000140000000-0x0000000140E6D000-memory.dmp
memory/1468-166-0x00007FF615B30000-0x00007FF615B44000-memory.dmp
memory/1468-11-0x0000000140000000-0x0000000140E6D000-memory.dmp
memory/1468-7-0x00007FF615B30000-0x00007FF615B44000-memory.dmp
memory/1468-1-0x0000000140000000-0x0000000140E6D000-memory.dmp
memory/1676-43-0x00007FF744BD0000-0x00007FF744BDB000-memory.dmp
memory/1820-151-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/2076-150-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/2256-46-0x0000017677DC0000-0x0000017678DC8000-memory.dmp
memory/2256-47-0x0000017677DC0000-0x0000017678DC8000-memory.dmp
memory/2256-60-0x00007FF7E6CD0000-0x00007FF7E6CF5000-memory.dmp
memory/2256-55-0x0000017677DC0000-0x0000017678DC8000-memory.dmp
memory/2256-54-0x0000017677DC0000-0x0000017678DC8000-memory.dmp
memory/2256-53-0x0000017677DC0000-0x0000017678DC8000-memory.dmp
memory/2256-48-0x0000017677DC0000-0x0000017678DC8000-memory.dmp
memory/2276-133-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/2476-92-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/2624-45-0x00007FF744BD0000-0x00007FF744BDB000-memory.dmp
memory/2744-139-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/2800-51-0x00007FF744BD0000-0x00007FF744BDB000-memory.dmp
memory/2940-52-0x00007FF744BD0000-0x00007FF744BDB000-memory.dmp
memory/3044-93-0x0000020A69F50000-0x0000020A6AF58000-memory.dmp
memory/3044-103-0x0000020A69F50000-0x0000020A6AF58000-memory.dmp
memory/3044-102-0x0000020A69F50000-0x0000020A6AF58000-memory.dmp
memory/3044-104-0x0000020A69F50000-0x0000020A6AF58000-memory.dmp
memory/3044-109-0x00007FF6C3080000-0x00007FF6C30A5000-memory.dmp
memory/3044-94-0x0000020A69F50000-0x0000020A6AF58000-memory.dmp
memory/3044-95-0x0000020A69F50000-0x0000020A6AF58000-memory.dmp
memory/3760-152-0x000001311E160000-0x000001311F168000-memory.dmp
memory/3760-159-0x00007FF6C3080000-0x00007FF6C30A5000-memory.dmp
memory/3760-145-0x000001311E160000-0x000001311F168000-memory.dmp
memory/3760-153-0x000001311E160000-0x000001311F168000-memory.dmp
memory/3760-154-0x000001311E160000-0x000001311F168000-memory.dmp
memory/3760-144-0x000001311E160000-0x000001311F168000-memory.dmp
memory/3760-143-0x000001311E160000-0x000001311F168000-memory.dmp
memory/4216-38-0x00007FF744BD0000-0x00007FF744BDB000-memory.dmp
memory/4284-76-0x0000000140000000-0x0000000140E6D000-memory.dmp
memory/4284-78-0x00007FF79A9F0000-0x00007FF79AA04000-memory.dmp
memory/4284-74-0x0000000140000000-0x0000000140E6D000-memory.dmp
memory/4284-72-0x00007FF79A9F0000-0x00007FF79AA04000-memory.dmp
memory/4304-86-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/4596-21-0x0000000140000000-0x0000000140E6D000-memory.dmp
memory/4596-12-0x0000000140000000-0x0000000140E6D000-memory.dmp
memory/4596-10-0x00007FF79A9F0000-0x00007FF79AA04000-memory.dmp
memory/4632-142-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp
memory/4848-41-0x00007FF744BD0000-0x00007FF744BDB000-memory.dmp
memory/5028-100-0x00007FF7BAE40000-0x00007FF7BAE4B000-memory.dmp