Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 12:20
General
- Target google.exe
- Size 18.5MB
- Sample260930-ph3dcsxblh
- SHA256 fb7460f1febcc0f1e96f2df6c4b940f3beac750ce8cd1f30f98086400fbbe20e
Malware Config
Signatures
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\google.exe"C:\Users\Admin\AppData\Local\Temp\google.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-ac 0 monitor-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /change standby-timeout-dc 0 monitor-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exeC:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupdt.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupw.exeC:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\gupw.exe /watchu2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe"C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe" /user1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exeC:\Users\Admin\AppData\Local\Google\Chrome\k0re8n0bvr\chrome140.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome140.exe
google.dll
memory/2012-11-0x00007FF7A4ED0000-0x00007FF7A605C000-memory.dmp
memory/3596-22-0x000001FC6A560000-0x000001FC6A580000-memory.dmp
memory/3596-26-0x00007FF727560000-0x00007FF7286EC000-memory.dmp
memory/3780-2-0x00007FF627F90000-0x00007FF62911C000-memory.dmp
memory/3780-12-0x00007FF627F90000-0x00007FF62911C000-memory.dmp
memory/3780-25-0x00007FF627F90000-0x00007FF62911C000-memory.dmp
memory/4044-24-0x00007FF7A4ED0000-0x00007FF7A605C000-memory.dmp
memory/4968-27-0x00007FF7805D0000-0x00007FF78175C000-memory.dmp