f31a7c231dcc34600e7fcf0347c3ae36eff022296e1d77fc60488cef63281129

Analysis

max time kernel
151s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 00:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 25.4MB
Sample261022-adv16abw2m
SHA256 f31a7c231dcc34600e7fcf0347c3ae36eff022296e1d77fc60488cef63281129
MD5 7d36be2f25c0647a11524f252dcf1059
SHA1 3664582f14b4fc6ad83a7aceab2eb0522019d81e
SHA512 1295ce1004a2a90de8b3cc48d0c2f608f79ffc67cf16c50c17324a528d856271f5ccd5caff7a73180e98342f5816c50d0d63faf1b5755f16317d0f901175f4d3
SSDEEP 393216:FzKu/asDwDpiPo2Ndo2Kj3NY+TSfZBarM2L8Xd:FTbw9iDXKj3e+ufZBT2cd
TLSH
T1D347AF51B30B15F6FF434C3645F9AB2F7B3AE2DC8874C55AE4282426BAA3C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4344	GoogleBrowserProcess.exe
6044	GoogleSyncTask.exe
2332	GoogleBrowserMonitor.exe
2040	GoogleSyncTask.exe
5608	GoogleSyncTask.exe
6092	GoogleSyncTask.exe
496	GoogleSyncTask.exe
3316	GoogleSyncTask.exe
1632	GoogleSyncTask.exe
3824	GoogleSyncTask.exe
2852	GoogleSyncTask.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdateDaemon64 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\l3h7ge77w2\\GoogleBrowserProcess.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1016	file.exe
1016	file.exe
1016	file.exe
1016	file.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe
2332	GoogleBrowserMonitor.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 6044	1016	file.exe	92
PID 1016 wrote to memory of 2332	1016	file.exe	93
PID 2332 wrote to memory of 2040	2332	GoogleBrowserMonitor.exe	94
PID 2332 wrote to memory of 5608	2332	GoogleBrowserMonitor.exe	95
PID 2332 wrote to memory of 6092	2332	GoogleBrowserMonitor.exe	96
PID 2332 wrote to memory of 496	2332	GoogleBrowserMonitor.exe	97
PID 2332 wrote to memory of 3316	2332	GoogleBrowserMonitor.exe	98
PID 2332 wrote to memory of 1632	2332	GoogleBrowserMonitor.exe	99
PID 2332 wrote to memory of 3824	2332	GoogleBrowserMonitor.exe	100
PID 2332 wrote to memory of 2852	2332	GoogleBrowserMonitor.exe	101

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
  2⤵
  - Executes dropped EXE
  PID:6044
- C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleBrowserMonitor.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleBrowserMonitor.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:2040
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:5608
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:6092
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:496
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:3316
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:1632
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:3824
- - C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe"
    3⤵
    - Executes dropped EXE
    PID:2852

C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleBrowserProcess.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleBrowserProcess.exe" /user
1⤵
- Executes dropped EXE
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleBrowserProcess.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleBrowserProcess.exe
Size 25.4MB
SHA256 f31a7c231dcc34600e7fcf0347c3ae36eff022296e1d77fc60488cef63281129
MD5 7d36be2f25c0647a11524f252dcf1059
SHA1 3664582f14b4fc6ad83a7aceab2eb0522019d81e
SHA512 1295ce1004a2a90de8b3cc48d0c2f608f79ffc67cf16c50c17324a528d856271f5ccd5caff7a73180e98342f5816c50d0d63faf1b5755f16317d0f901175f4d3
SSDEEP 393216:FzKu/asDwDpiPo2Ndo2Kj3NY+TSfZBarM2L8Xd:FTbw9iDXKj3e+ufZBT2cd
TLSH
T1D347AF51B30B15F6FF434C3645F9AB2F7B3AE2DC8874C55AE4282426BAA3C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleSyncTask.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\GoogleSyncTask.exe
Size 3.2MB
SHA256 56bc4876db3e12d11e30e6c57cc8402c793dff5109a0001679b7f8f3657d6183
MD5 1cc7a7b51e9e4aa38cef840afe1d9e4e
SHA1 cc27b72e50a739a66d970c402df255a8df45e434
SHA512 5b34442da52c87b5bcab7cd115f2199b440358390aef15d4c4dc5e5494b16980771ce7298b220af8ffb8e68d4a4824134644feb2a2ab07fc9a5ebb3fb97e4011
SSDEEP 24576:Hv0HaXA2Ag2ktpmqYb0agK/7eq+Ek0ZQceP9lXMTB:Hv0M5XziznTB
TLSH
T123F51A91B70F19F1BA875C3785F6A92F3B36E1DC8DB0C459F8253857F39280A86AC191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gucheck.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\l3h7ge77w2\gucheck.dll
Size 2.0MB
SHA256 80763fead9c6e5e5f3967eddd7f361a41edfdf4c080c54151c441c861e168cd8
MD5 fa9fea9ad5ef4159527d17673c36f244
SHA1 4000a01402d41628ade6cf97fc7baad5bb7069f2
SHA512 2ef8056f7988d817ad7a5bef7d6524e7f75c2f62bb506ce08e6a64f7295a9ae4c1178ff74db7d7fef0ea0e01c2d29bb4b5c23dd36989b99505491a6f9071075e
SSDEEP 24576:dF0/acKIFVZGQuogFuZcxVJdtQXsj9Fqkqa1OuUlTGCAQ:cTGhon2la2ikqaB0AQ
TLSH
T14095E605F35715CFEF9581706D7DA311EA9DCBA8A08CCA779A5C82793CB3C6E1884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/496-28-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download

memory/1016-7-0x00007FF6EBC50000-0x00007FF6ED566000-memory.dmp

Download

memory/1016-2-0x00007FF6EBC50000-0x00007FF6ED566000-memory.dmp

Download

memory/1016-18-0x00007FF6EBC50000-0x00007FF6ED566000-memory.dmp

Download

memory/1016-3-0x00007FF6EBC50000-0x00007FF6ED566000-memory.dmp

Download

memory/1632-35-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download

memory/2040-20-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download

memory/2332-21-0x00007FF6CE2E0000-0x00007FF6CFBF6000-memory.dmp

Download

memory/3316-32-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download

memory/3824-38-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download

memory/4344-5-0x00007FF6E9A60000-0x00007FF6EB376000-memory.dmp

Download

memory/5608-24-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download

memory/6044-16-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download

memory/6092-26-0x00007FF7500D0000-0x00007FF7519E6000-memory.dmp

Download