21516e7ff041dbee1df154a7155510604618123d3b67bd1b9f824814bffd290d

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 25.8MB
Sample261020-3ada6abs3m
SHA256 21516e7ff041dbee1df154a7155510604618123d3b67bd1b9f824814bffd290d
MD5 c6931366a3b2afe31eca73b4c3765e8e
SHA1 93d8ab57aaa066297447114437ba39c299d53460
SHA512 df78127231f1aab45b7b0b65a321ef66849b5cb51dcefbd2b2dbe2c56619a4dcaa888bb50f68086ea1ec0b639c4200230aa61de42e92aa0f012c1914567b2df6
SSDEEP 393216:smOa+L6oMMEVMpPKFoSPc5TEH92LACnGwRViPWwLh9C8:Pm6oMrV/FoRpEH92LMeVOWym8
TLSH
T1B057A051F30B05F6FF434C3645F9AB2F7B39E2DC8974C55AE428243ABAA2C1B459C291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 5 IoCs

pid	Process
2124	GoogleBrowserServiceHost.exe
5484	GoogleSyncTask.exe
5644	ChromeTaskMonitor.exe
2464	GoogleSyncTask.exe
988	GoogleSyncTask.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdClient64 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\wo3hlt2u8h\\GoogleBrowserServiceHost.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4284	file.exe
4284	file.exe
4284	file.exe
4284	file.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe
5644	ChromeTaskMonitor.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4284 wrote to memory of 5484	4284	file.exe	92
PID 4284 wrote to memory of 5644	4284	file.exe	93
PID 5644 wrote to memory of 2464	5644	ChromeTaskMonitor.exe	94
PID 5644 wrote to memory of 988	5644	ChromeTaskMonitor.exe	95

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleSyncTask.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleSyncTask.exe"
  2⤵
  - Executes dropped EXE
  PID:5484
- C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\ChromeTaskMonitor.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\ChromeTaskMonitor.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:2464
- - C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:988

C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleBrowserServiceHost.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleBrowserServiceHost.exe" /user
1⤵
- Executes dropped EXE
PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleBrowserServiceHost.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleBrowserServiceHost.exe
Size 25.8MB
SHA256 21516e7ff041dbee1df154a7155510604618123d3b67bd1b9f824814bffd290d
MD5 c6931366a3b2afe31eca73b4c3765e8e
SHA1 93d8ab57aaa066297447114437ba39c299d53460
SHA512 df78127231f1aab45b7b0b65a321ef66849b5cb51dcefbd2b2dbe2c56619a4dcaa888bb50f68086ea1ec0b639c4200230aa61de42e92aa0f012c1914567b2df6
SSDEEP 393216:smOa+L6oMMEVMpPKFoSPc5TEH92LACnGwRViPWwLh9C8:Pm6oMrV/FoRpEH92LMeVOWym8
TLSH
T1B057A051F30B05F6FF434C3645F9AB2F7B39E2DC8974C55AE428243ABAA2C1B459C291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleSyncTask.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\GoogleSyncTask.exe
Size 10.0MB
SHA256 cfa311ec3c58c2b8babec07c3c3ce6bff45e64535b7ce13b8435de16441f274c
MD5 bdfcb56e77327e8ce37f0b4dbdbe6616
SHA1 bc838bc9d3fc2b349ab5ba8fe251578eb25885c8
SHA512 07b0df7545b761f345bee2405e5892d8b311803dce58d56124b4d11842765b8e5703fa9d6687bc15dbe967aecf34dd3875a57c63c52641e98f31ab3ed04040ac
SSDEEP 98304:KbyZaqyZmOajKL6I5PQWM8pp/sfcEqM84B:oSomOajKL6IPQWMA/EqM8U
TLSH
T173B6D891B60F09F2FA475C3785F6A92F7B36E1DD8DB0C459F8353816E39281A86EC190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmagent.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\wo3hlt2u8h\chrmagent.dll
Size 2.0MB
SHA256 1c4ddb6b60ace145428db388165531538070badf41a33bb5bc8859f2affec155
MD5 7d606bd9e88864bea7303ad6da2f188a
SHA1 c9fbfd9cb08b2958eb8f7e921ef9e140cced66bf
SHA512 bbe80b2b55720d3d57cdf15563677993ccec61196024178c6ad550a8325fbffabd6369d78ef5f41b133236e16152ddcdbfbe60380ddefece9c6489cf87d1222d
SSDEEP 24576:hMvpI9ylhKmN9priU7Zjbgudu/5gr7F15UX+w/F0JDTirRSd:GvwylJbiutWX+eF0JD+lSd
TLSH
T132A5D505F35715CFEF5541B06DBDB712EA5DCBA8A188CA379A5C827D3CB2C2E1884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/988-25-0x00007FF715E10000-0x00007FF71779B000-memory.dmp

Download

memory/2124-5-0x00007FF7D6430000-0x00007FF7D7DBB000-memory.dmp

Download

memory/2464-23-0x00007FF715E10000-0x00007FF71779B000-memory.dmp

Download

memory/4284-2-0x00007FF79ACF0000-0x00007FF79C67B000-memory.dmp

Download

memory/4284-6-0x00007FF79ACF0000-0x00007FF79C67B000-memory.dmp

Download

memory/4284-8-0x00007FF79ACF0000-0x00007FF79C67B000-memory.dmp

Download

memory/4284-12-0x00007FF79ACF0000-0x00007FF79C67B000-memory.dmp

Download

memory/4284-21-0x00007FF79ACF0000-0x00007FF79C67B000-memory.dmp

Download

memory/5484-19-0x00007FF715E10000-0x00007FF71779B000-memory.dmp

Download