3dc3cef7a32294cfce498884f5ca741fc2535a92bca9d0fc620f44c22d24fdd0

Analysis

max time kernel
36s
max time network
19s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3dc3cef7a32294cf.bin.exe
Size 18.4MB
Sample261014-a6fryatt8k
SHA256 3dc3cef7a32294cfce498884f5ca741fc2535a92bca9d0fc620f44c22d24fdd0
MD5 2c16a37059361e60568f0dd16e976485
SHA1 61e90644e8af5d6f56564f3316263450bc2b7093
SHA512 6f0c4737773473f305f96ddf1aca490cfd0d75993c094f5401d15840ff65da43a25f839c3168f06ee377ab7ff883d33a267be1d667f553aa44b749328f547366
SSDEEP 393216:nVhpxD58MtPuUKnDWDsD5DCM5PuUK5xO5nhqp:3r58MtfDeDCM5v5hY
TLSH
T149172305B78749DFDB16C274587DF330F93DEAA46245CB3B86A8827D3D62C2A29C1391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1112	GoogleWebShell.exe
6108	ChromeCacheService.exe
5284	ChromeHealthService.exe
3644	ChromeCacheService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate140 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\w87857arii\\GoogleWebShell.exe\" /user"	3dc3cef7a32294cf.bin.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3436	3dc3cef7a32294cf.bin.exe
3436	3dc3cef7a32294cf.bin.exe
3436	3dc3cef7a32294cf.bin.exe
3436	3dc3cef7a32294cf.bin.exe
5284	ChromeHealthService.exe
5284	ChromeHealthService.exe
5284	ChromeHealthService.exe
5284	ChromeHealthService.exe
5284	ChromeHealthService.exe
5284	ChromeHealthService.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 6108	3436	3dc3cef7a32294cf.bin.exe	92
PID 3436 wrote to memory of 5284	3436	3dc3cef7a32294cf.bin.exe	93
PID 5284 wrote to memory of 3644	5284	ChromeHealthService.exe	94

C:\Users\Admin\AppData\Local\Temp\3dc3cef7a32294cf.bin.exe
"C:\Users\Admin\AppData\Local\Temp\3dc3cef7a32294cf.bin.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\ChromeCacheService.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\ChromeCacheService.exe
  2⤵
  - Executes dropped EXE
  PID:6108
- C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\ChromeHealthService.exe
  C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\ChromeHealthService.exe /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5284
- - C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\ChromeCacheService.exe
    C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\ChromeCacheService.exe
    3⤵
    - Executes dropped EXE
    PID:3644

C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\GoogleWebShell.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\GoogleWebShell.exe" /user
1⤵
- Executes dropped EXE
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleWebShell.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\GoogleWebShell.exe
Size 18.4MB
SHA256 3dc3cef7a32294cfce498884f5ca741fc2535a92bca9d0fc620f44c22d24fdd0
MD5 2c16a37059361e60568f0dd16e976485
SHA1 61e90644e8af5d6f56564f3316263450bc2b7093
SHA512 6f0c4737773473f305f96ddf1aca490cfd0d75993c094f5401d15840ff65da43a25f839c3168f06ee377ab7ff883d33a267be1d667f553aa44b749328f547366
SSDEEP 393216:nVhpxD58MtPuUKnDWDsD5DCM5PuUK5xO5nhqp:3r58MtfDeDCM5v5hY
TLSH
T149172305B78749DFDB16C274587DF330F93DEAA46245CB3B86A8827D3D62C2A29C1391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guclient.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\w87857arii\guclient.dll
Size 572KB
SHA256 5c5fd75cb0bd0b28eebc5bf89e48ef25a63fea7ea2a08716d53e25e3eea598ff
MD5 8f5c61a83bb0b360b48408431bf60695
SHA1 516297a857a0bab020b3eef960748ca985f1c125
SHA512 090be5a5986ffb60111ce59f17b7bfc7ae50e1413ed3bd36608c1cd311af4d3829180b86fd596e133b4d71b3f346a22e2430626d2c1d129a245f757b0a88a59a
SSDEEP 6144:NbDOYMl9k4RG2Yle4NUQF8+VxpLrJB2Ensi5aRPyCDzY/HBrnc/tgy4L3tNlITNa:Nf49k4LYogzF8+Vfrpn75aRLzSr
TLSH
T1F0C41A15B7571ADBCE158278187DE321FA6DDAE4A242CB778A5C827C3C73C6A18C13D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1112-4-0x00007FF7ACEE0000-0x00007FF7AE053000-memory.dmp

Download

memory/3436-2-0x00007FF698DA0000-0x00007FF699F13000-memory.dmp

Download

memory/3436-5-0x00007FF698DA0000-0x00007FF699F13000-memory.dmp

Download

memory/3436-6-0x00007FF698DA0000-0x00007FF699F13000-memory.dmp

Download

memory/3644-12-0x00007FF77DFA0000-0x00007FF77F113000-memory.dmp

Download

memory/6108-9-0x00007FF77DFA0000-0x00007FF77F113000-memory.dmp

Download