07bb1fa174d9706dfcf9b9ae79b30f7edb5408ead9635cda83aac27fcf533328

Analysis

max time kernel
151s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/10/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 26.2MB
Sample261021-3plk3sgf86
SHA256 07bb1fa174d9706dfcf9b9ae79b30f7edb5408ead9635cda83aac27fcf533328
MD5 b5a65f24fd03f533ca34ae8bda200881
SHA1 90873ffecda04b594365bef84791033412956e9a
SHA512 8940203a8d34ce1526b442b70d758b0d866f4366848998304edcdbcfb50381ee0a46f351205cdded02979cb405c23ec2853d332f2a813772d58728fd104cece9
SSDEEP 393216:tVPNhuv9LeTSs7AaYDAM+0HFNgxtwePK8JSoeQb1O1X:/iFLmSBaYEIH6wSK8JSobOp
TLSH
T1B057A051B30B05F6FF434C3645FAAB2F7B39E2DC8974C55AE428342A7AA2C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4744	GoogleBrowserUpdate.exe
1312	ChromeSessionHelper.exe
1440	ChromeSessionManager.exe
1576	ChromeSessionHelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdateCore32 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\9b9e6orcer\\GoogleBrowserUpdate.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4168	file.exe
4168	file.exe
4168	file.exe
4168	file.exe
1440	ChromeSessionManager.exe
1440	ChromeSessionManager.exe
1440	ChromeSessionManager.exe
1440	ChromeSessionManager.exe
1440	ChromeSessionManager.exe
1440	ChromeSessionManager.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 1312	4168	file.exe	92
PID 4168 wrote to memory of 1440	4168	file.exe	93
PID 1440 wrote to memory of 1576	1440	ChromeSessionManager.exe	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\ChromeSessionHelper.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\ChromeSessionHelper.exe"
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\ChromeSessionManager.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\ChromeSessionManager.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\ChromeSessionHelper.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\ChromeSessionHelper.exe"
    3⤵
    - Executes dropped EXE
    PID:1576

C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\GoogleBrowserUpdate.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\GoogleBrowserUpdate.exe" /user
1⤵
- Executes dropped EXE
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleBrowserUpdate.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\GoogleBrowserUpdate.exe
Size 26.2MB
SHA256 07bb1fa174d9706dfcf9b9ae79b30f7edb5408ead9635cda83aac27fcf533328
MD5 b5a65f24fd03f533ca34ae8bda200881
SHA1 90873ffecda04b594365bef84791033412956e9a
SHA512 8940203a8d34ce1526b442b70d758b0d866f4366848998304edcdbcfb50381ee0a46f351205cdded02979cb405c23ec2853d332f2a813772d58728fd104cece9
SSDEEP 393216:tVPNhuv9LeTSs7AaYDAM+0HFNgxtwePK8JSoeQb1O1X:/iFLmSBaYEIH6wSK8JSobOp
TLSH
T1B057A051B30B05F6FF434C3645FAAB2F7B39E2DC8974C55AE428342A7AA2C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromecore.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\9b9e6orcer\chromecore.dll
Size 2.2MB
SHA256 fe9c8307d9a2cfde4716393e35703c1fb3c0cb1d7adeae8c9691bbc66b5818ce
MD5 f9a85ff66353209b5a008513923ac62e
SHA1 3c9bc1d88b67e5bab9d98be50e70f927867adab8
SHA512 1f7cfa106381dbf5a929f227483a117f05c0e7cbc0aa583c4d3d025b5581594f63ab65167236b364521b963b2a3f1ba085eb519d893af7e6788f671f2b34a8f8
SSDEEP 24576:0U3t0kUN8BywqoY16Trfk6gbodaLLPvbtxLVq4OfOf5xgSeCP0AQ:02YL3bOfYrgSn8AQ
TLSH
T1A0B5E505F35715CFEF9581B06DBDB312EA5DCBA4A048CA379A5C927D3CB2C2E1884396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-19-0x00007FF753CC0000-0x00007FF7556A3000-memory.dmp

Download

memory/1576-23-0x00007FF753CC0000-0x00007FF7556A3000-memory.dmp

Download

memory/4168-2-0x00007FF7FBD70000-0x00007FF7FD753000-memory.dmp

Download

memory/4168-6-0x00007FF7FBD70000-0x00007FF7FD753000-memory.dmp

Download

memory/4168-9-0x00007FF7FBD70000-0x00007FF7FD753000-memory.dmp

Download

memory/4168-20-0x00007FF7FBD70000-0x00007FF7FD753000-memory.dmp

Download

memory/4744-5-0x00007FF6F13A0000-0x00007FF6F2D83000-memory.dmp

Download