Analysis
- max time kernel
145s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
04/10/2026, 02:20
General
- Target c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd.exe
- Size 21.4MB
- Sample261004-csptsstsbw
- SHA256 c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd
Malware Config
Signatures
- Executes dropped EXE 24 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd.exe"C:\Users\Admin\AppData\Local\Temp\c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe"C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe" /install22⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\crashpad_handler.exe"C:\ProgramData\Google\Update\uwcb7udt\crashpad_handler.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\chrome.exe"C:\ProgramData\Google\Update\uwcb7udt\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.EMJXKMXFQ4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" -L5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=name,driver_version --format=csv,noheader5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=pci.bus_id --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=memory.total --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=power.limit,power.default_limit --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=temperature.gpu,clocks.sm,clocks.mem,fan.speed,power.draw,power.draw.instant --format=csv,noheader,nounits5⤵
- Executes dropped EXE
-
-
-
-
C:\ProgramData\Google\Update\uwcb7udt\chrome.exe"C:\ProgramData\Google\Update\uwcb7udt\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.EMJXKMXFQ3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" -L4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=name,driver_version --format=csv,noheader4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=pci.bus_id --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=memory.total --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=power.limit,power.default_limit --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=temperature.gpu,clocks.sm,clocks.mem,fan.speed,power.draw,power.draw.instant --format=csv,noheader,nounits4⤵
- Executes dropped EXE
-
-
-
-
C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe"C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe" /run1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\chrome.exe"C:\ProgramData\Google\Update\uwcb7udt\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.EMJXKMXFQ2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" -L3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=name,driver_version --format=csv,noheader3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=pci.bus_id --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=memory.total --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=power.limit,power.default_limit --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
C:\ProgramData\Google\Update\uwcb7udt\nvidia-smi.exe"nvidia-smi" --query-gpu=temperature.gpu,clocks.sm,clocks.mem,fan.speed,power.draw,power.draw.instant --format=csv,noheader,nounits3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome.dll
chrome.exe
crashpad_handler.exe
googleupdater.exe
nvidia-smi.exe
memory/452-102-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/620-44-0x00007FF681550000-0x00007FF68155B000-memory.dmp
memory/1020-149-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/1088-8-0x00007FF698660000-0x00007FF6987AB000-memory.dmp
memory/1088-12-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/1088-2-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/1088-0-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/1088-133-0x00007FF698660000-0x00007FF6987AB000-memory.dmp
memory/1352-21-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/1352-11-0x00007FF727D50000-0x00007FF727E9B000-memory.dmp
memory/1556-83-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-135-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-122-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-125-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-128-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-131-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-79-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-137-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1556-69-0x00007FF6F6890000-0x00007FF6F68BA000-memory.dmp
memory/1652-93-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/1800-152-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/2168-42-0x00007FF681550000-0x00007FF68155B000-memory.dmp
memory/2248-111-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/2292-163-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/2896-110-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/3352-155-0x0000019FCFB70000-0x0000019FD0B3A000-memory.dmp
memory/3352-169-0x00007FF7B11E0000-0x00007FF7B120C000-memory.dmp
memory/3352-154-0x0000019FCFB70000-0x0000019FD0B3A000-memory.dmp
memory/3352-153-0x0000019FCFB70000-0x0000019FD0B3A000-memory.dmp
memory/3352-161-0x0000019FCFB70000-0x0000019FD0B3A000-memory.dmp
memory/3352-164-0x0000019FCFB70000-0x0000019FD0B3A000-memory.dmp
memory/3352-162-0x0000019FCFB70000-0x0000019FD0B3A000-memory.dmp
memory/3516-96-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/3752-48-0x00007FF681550000-0x00007FF68155B000-memory.dmp
memory/4160-112-0x0000015FC5FD0000-0x0000015FC6F9A000-memory.dmp
memory/4160-113-0x0000015FC5FD0000-0x0000015FC6F9A000-memory.dmp
memory/4160-104-0x0000015FC5FD0000-0x0000015FC6F9A000-memory.dmp
memory/4160-103-0x0000015FC5FD0000-0x0000015FC6F9A000-memory.dmp
memory/4160-115-0x0000015FC5FD0000-0x0000015FC6F9A000-memory.dmp
memory/4160-119-0x00007FF7B11E0000-0x00007FF7B120C000-memory.dmp
memory/4160-105-0x0000015FC5FD0000-0x0000015FC6F9A000-memory.dmp
memory/4540-54-0x00007FF681550000-0x00007FF68155B000-memory.dmp
memory/4808-88-0x00007FF727D50000-0x00007FF727E9B000-memory.dmp
memory/4808-70-0x00007FF727D50000-0x00007FF727E9B000-memory.dmp
memory/4808-86-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/4932-160-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/4976-57-0x00007FF681550000-0x00007FF68155B000-memory.dmp
memory/5152-146-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/5272-143-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/5600-99-0x00007FF7DCE50000-0x00007FF7DCE5B000-memory.dmp
memory/5832-60-0x000001A77BB10000-0x000001A77CADA000-memory.dmp
memory/5832-56-0x000001A77BB10000-0x000001A77CADA000-memory.dmp
memory/5832-50-0x000001A77BB10000-0x000001A77CADA000-memory.dmp
memory/5832-49-0x000001A77BB10000-0x000001A77CADA000-memory.dmp
memory/5832-55-0x000001A77BB10000-0x000001A77CADA000-memory.dmp
memory/5832-63-0x00007FF7E1E30000-0x00007FF7E1E5C000-memory.dmp
memory/5832-51-0x000001A77BB10000-0x000001A77CADA000-memory.dmp
memory/5984-46-0x00007FF681550000-0x00007FF68155B000-memory.dmp