bad8dc763cb740b43723e21b6ba1b083ebdd724ddf95a3243100d9a47a92743d

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 25.9MB
Sample261020-3ey4esdf48
SHA256 bad8dc763cb740b43723e21b6ba1b083ebdd724ddf95a3243100d9a47a92743d
MD5 974003e8b36079f119ff5c780413d368
SHA1 61b04a0bdc2e3c9b0fa6a7a218e2115d9f5e5d29
SHA512 08958f72d6eebba091b464e599246dc917c09c906616b12ffcf9b59ec344a843d0035918e60c5099a079b14ae4eee34729ea98c2890b5e0d760ae715e4b5ee2c
SSDEEP 393216:29igXiXTD6ZHhgAk2BHcOWBxs1hyrzmc6LT5AwMWLexZc/En:IigXiSSAkyHzSxs1hyrzm9LMWl/k
TLSH
T1BB57AF51F30B05F6FB434C3645F9AB2F7B39E2DC8974C556E828242ABAA2C1F45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 13 IoCs

pid	Process
5996	GoogleBrowserServiceHost.exe
1836	ChromeSyncService.exe
3956	ChromeSessionMonitor.exe
2332	ChromeSyncService.exe
2124	ChromeSyncService.exe
4232	ChromeSyncService.exe
5608	ChromeSyncService.exe
248	ChromeSyncService.exe
3316	ChromeSyncService.exe
2536	ChromeSyncService.exe
2976	ChromeSyncService.exe
5932	ChromeSyncService.exe
2392	ChromeSyncService.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\GUpdateDaemon64 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\pviq7c8svg\\GoogleBrowserServiceHost.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4684	file.exe
4684	file.exe
4684	file.exe
4684	file.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe
3956	ChromeSessionMonitor.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 1836	4684	file.exe	92
PID 4684 wrote to memory of 3956	4684	file.exe	93
PID 3956 wrote to memory of 2332	3956	ChromeSessionMonitor.exe	94
PID 3956 wrote to memory of 2124	3956	ChromeSessionMonitor.exe	95
PID 3956 wrote to memory of 4232	3956	ChromeSessionMonitor.exe	96
PID 3956 wrote to memory of 5608	3956	ChromeSessionMonitor.exe	97
PID 3956 wrote to memory of 248	3956	ChromeSessionMonitor.exe	98
PID 3956 wrote to memory of 3316	3956	ChromeSessionMonitor.exe	99
PID 3956 wrote to memory of 2536	3956	ChromeSessionMonitor.exe	100
PID 3956 wrote to memory of 2976	3956	ChromeSessionMonitor.exe	101
PID 3956 wrote to memory of 5932	3956	ChromeSessionMonitor.exe	102
PID 3956 wrote to memory of 2392	3956	ChromeSessionMonitor.exe	103

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSessionMonitor.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSessionMonitor.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3956
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:2332
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:2124
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:4232
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:5608
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:248
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:3316
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:2536
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:2976
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:5932
- - C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe"
    3⤵
    - Executes dropped EXE
    PID:2392

C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\GoogleBrowserServiceHost.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\GoogleBrowserServiceHost.exe" /user
1⤵
- Executes dropped EXE
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeSyncService.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\ChromeSyncService.exe
Size 15.6MB
SHA256 30324d5eb626c990fa7c5f854b281edf22395a0e8f8965daf6810c704be04c41
MD5 282a4c54eb91266bb2c92e107b28e041
SHA1 18a76f1d841df67d66bf875bf986682b0b48b1a7
SHA512 e2b81a22e5156cccfa7a37673b9b1712adbc938e23ad5be328df524211848b4e4eb6d316072a2d5cc4f2a76e1d118c782313d5ff7e577ed9ec790e4cdaa573ba
SSDEEP 196608:29ig6zQViXTDjG8yHmJUgLerHEU4UXBQ2ZcO4Fj:29igXiXTD6ZHhgAk2BHcO0
TLSH
T18DF65D51B30F05F6FB435C3645F9AB2F7B3AE2DC8974C559E4282826B6A2C1F85DC290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleBrowserServiceHost.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\GoogleBrowserServiceHost.exe
Size 25.9MB
SHA256 bad8dc763cb740b43723e21b6ba1b083ebdd724ddf95a3243100d9a47a92743d
MD5 974003e8b36079f119ff5c780413d368
SHA1 61b04a0bdc2e3c9b0fa6a7a218e2115d9f5e5d29
SHA512 08958f72d6eebba091b464e599246dc917c09c906616b12ffcf9b59ec344a843d0035918e60c5099a079b14ae4eee34729ea98c2890b5e0d760ae715e4b5ee2c
SSDEEP 393216:29igXiXTD6ZHhgAk2BHcOWBxs1hyrzmc6LT5AwMWLexZc/En:IigXiSSAkyHzSxs1hyrzm9LMWl/k
TLSH
T1BB57AF51F30B05F6FB434C3645F9AB2F7B39E2DC8974C556E828242ABAA2C1F45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gubrowser.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\pviq7c8svg\gubrowser.dll
Size 2.1MB
SHA256 e1bf453e308cb82893351981ae1ec500618a491be956823cf5fe020e6bdb5fda
MD5 2d37f72ef51613890ee684f409aeb9e9
SHA1 90cec973f46fa65188935634f9dfdc2b8e781b87
SHA512 b800e88ae33034841f704e1c91d16689cae140e3e3474e2d550941c6919cae13307fcc4519d4f3a99735e2e0a94b9e7fc186a69d493f5df201e977f3956c630f
SSDEEP 24576:HXUT2ltMKFSf2+pniGXFJoExAXerJ7xcLOWQUGAfzQ6XQkm/4Po/Sd:F2BBf+5QUXzQ6X9m4P8Sd
TLSH
T1F8A5E505F35715CFEF9541B06DBDA312EA5DCBA4A18CCA379A5C927D3CB2C2E1884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-31-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/1836-15-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/2124-23-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/2332-19-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/2392-46-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/2536-37-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/2976-40-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/3316-34-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/3956-20-0x00007FF657CF0000-0x00007FF65968F000-memory.dmp

Download

memory/4232-25-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/4684-2-0x00007FF794750000-0x00007FF7960EF000-memory.dmp

Download

memory/4684-17-0x00007FF794750000-0x00007FF7960EF000-memory.dmp

Download

memory/4684-11-0x00007FF794750000-0x00007FF7960EF000-memory.dmp

Download

memory/4684-7-0x00007FF794750000-0x00007FF7960EF000-memory.dmp

Download

memory/4684-3-0x00007FF794750000-0x00007FF7960EF000-memory.dmp

Download

memory/5608-28-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/5932-43-0x00007FF651D60000-0x00007FF6536FF000-memory.dmp

Download

memory/5996-5-0x00007FF6E8E10000-0x00007FF6EA7AF000-memory.dmp

Download