bdca4ab26cf56088c0cf1b0534b9c1d026e566702573f69024d0cba969bb2d07

Resubmissions

21/10/2026, 23:42

261021-3qgcrawzdy7

21/10/2026, 23:27

261021-3fkmesgf7210

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 24.9MB
Sample261021-3fkmesgf72
SHA256 bdca4ab26cf56088c0cf1b0534b9c1d026e566702573f69024d0cba969bb2d07
MD5 f5f15973e77e1a001520405d385fd3c5
SHA1 ee5d3305c4d0dc91c8931b15d66d7c4742eec25d
SHA512 6e0ca3ed229566e917708b59bb7fb080a5dcbc997efce5107071cb6c09b72e11b78168eee8eb12394c2bcddddcba5e5f6a56ed92f19d87b419d9bb2958cc7bee
SSDEEP 393216:zCC6bWAt8jE4QcQ+DplQtyjbdL455Blpq6tE5:zsWpjEnlqpzHdMDB0
TLSH
T1AE47B051B30F05F6FB435C3645F96B2F7B35E2DC8DB4C55AE428242ABAA2C1B46DC290
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
2848	GoogleBrowserCoreService.exe
1336	ChromeTaskHost.exe
2552	ChromeHealthService.exe
2468	ChromeTaskHost.exe
5848	ChromeTaskHost.exe
4712	ChromeTaskHost.exe
3780	ChromeTaskHost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdEngine = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\is4ktp25v1\\GoogleBrowserCoreService.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2604	file.exe
2604	file.exe
2604	file.exe
2604	file.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe
2552	ChromeHealthService.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 1336	2604	file.exe	92
PID 2604 wrote to memory of 2552	2604	file.exe	93
PID 2552 wrote to memory of 2468	2552	ChromeHealthService.exe	94
PID 2552 wrote to memory of 5848	2552	ChromeHealthService.exe	95
PID 2552 wrote to memory of 4712	2552	ChromeHealthService.exe	96
PID 2552 wrote to memory of 3780	2552	ChromeHealthService.exe	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe"
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeHealthService.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeHealthService.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe"
    3⤵
    - Executes dropped EXE
    PID:2468
- - C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe"
    3⤵
    - Executes dropped EXE
    PID:5848
- - C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe"
    3⤵
    - Executes dropped EXE
    PID:4712
- - C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe"
    3⤵
    - Executes dropped EXE
    PID:3780

C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\GoogleBrowserCoreService.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\GoogleBrowserCoreService.exe" /user
1⤵
- Executes dropped EXE
PID:2848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeTaskHost.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\ChromeTaskHost.exe
Size 16.4MB
SHA256 c1b61d10ece50f4a60206bb11c940b9101b339186671eff02e4b6cefa87be2c6
MD5 3740204e9fab796ab48a15698fda6bd0
SHA1 1a594f44c5f742d7e8761ec9df0cfd243ae1b5fe
SHA512 627f4ecf07d8be0a84967030f8677c402106cc556f16828d70496d23a231023a3b2d7d50f19c91962e2c5b8c454501c4ce3ca60c03f8f43de26895e1c2ffff27
SSDEEP 196608:BBqL+RnG1C55+bWFpwHtTapkuKa8OYqi4lKaIcDE+G:zCC6bWAt8jE4QcQ+
TLSH
T117077E51B30F05F2FB435C3645F9AB2F7B35E2DC8DB4C55AE428242ABAA2C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleBrowserCoreService.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\GoogleBrowserCoreService.exe
Size 24.9MB
SHA256 bdca4ab26cf56088c0cf1b0534b9c1d026e566702573f69024d0cba969bb2d07
MD5 f5f15973e77e1a001520405d385fd3c5
SHA1 ee5d3305c4d0dc91c8931b15d66d7c4742eec25d
SHA512 6e0ca3ed229566e917708b59bb7fb080a5dcbc997efce5107071cb6c09b72e11b78168eee8eb12394c2bcddddcba5e5f6a56ed92f19d87b419d9bb2958cc7bee
SSDEEP 393216:zCC6bWAt8jE4QcQ+DplQtyjbdL455Blpq6tE5:zsWpjEnlqpzHdMDB0
TLSH
T1AE47B051B30F05F6FB435C3645F96B2F7B35E2DC8DB4C55AE428242ABAA2C1B46DC290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmupdate.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\is4ktp25v1\chrmupdate.dll
Size 1.8MB
SHA256 38a0a5bb46dd06a970f96dcdf2d5a35a3fc02e33a51811f95e6b54260aeb2651
MD5 71b0c3cc8600f7f57cb6788b7fe75c85
SHA1 132002ae999f32664c1ba4006e1849bed8146529
SHA512 2e0579a10d549aa103a63f15ae8235c08c45e78251d37b27212e1242d6914c44840bfc1b015cc14387e4d0804b2eef4dc76c6456e2fba3b1678c81b53e08c223
SSDEEP 24576:DoW1FD7oOPiaegKA3czJlwVs/Z1tFq/AQ:rXoAiaHDIPtcAQ
TLSH
T12B85C405F71715CFEF5541B06DBDB712EA5D8BA4A98CCA378A5C827D3CB2C2E1884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1336-18-0x00007FF601660000-0x00007FF602EF6000-memory.dmp

Download

memory/2468-22-0x00007FF601660000-0x00007FF602EF6000-memory.dmp

Download

memory/2552-26-0x00007FF7A1590000-0x00007FF7A2E26000-memory.dmp

Download

memory/2604-6-0x00007FF6D5BB0000-0x00007FF6D7446000-memory.dmp

Download

memory/2604-20-0x00007FF6D5BB0000-0x00007FF6D7446000-memory.dmp

Download

memory/2604-7-0x00007FF6D5BB0000-0x00007FF6D7446000-memory.dmp

Download

memory/2604-2-0x00007FF6D5BB0000-0x00007FF6D7446000-memory.dmp

Download

memory/2848-5-0x00007FF7C5A10000-0x00007FF7C72A6000-memory.dmp

Download

memory/3780-30-0x00007FF601660000-0x00007FF602EF6000-memory.dmp

Download

memory/4712-28-0x00007FF601660000-0x00007FF602EF6000-memory.dmp

Download

memory/5848-24-0x00007FF601660000-0x00007FF602EF6000-memory.dmp

Download