5679fad9147c523a5db5f2e3bf8bcbde8cf44baca6eb706ae30ff20fd306fe5f

Analysis

max time kernel
151s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 25.9MB
Sample261022-bwf6dsha97
SHA256 5679fad9147c523a5db5f2e3bf8bcbde8cf44baca6eb706ae30ff20fd306fe5f
MD5 b16cd3e21ddf8967f3e1c088a1cc9690
SHA1 6986cd5a97ae7969dfdc8288fb2476d344cbf1cd
SHA512 bf03e545a381d47f75b1a1513190242b8787699c997bec6ac2d8636a535d0a272033c34548348b191e725c1852a0e868e8e57d7085de47a3f8051c48bac6cb8a
SSDEEP 393216:ZsAJXnt1sNAvHpBocJn4pCu9AV3LFKiVLe+CqTWuQa+nY:ZF1t1swpKAxMAV3LFnVLe+CqTWra8Y
TLSH
T12A57B051F30B05F6FF434C3645F9AB2F7B39E2DC8974C55AE428242ABAA2C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
2684	GoogleSecureUpdate.exe
5672	GoogleWebCache.exe
808	GoogleAppMonitor.exe
4372	GoogleWebCache.exe
1140	GoogleWebCache.exe
5744	GoogleWebCache.exe
3264	GoogleWebCache.exe
5796	GoogleWebCache.exe
5436	GoogleWebCache.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\i3lvbiv4qw\\GoogleSecureUpdate.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3232	file.exe
3232	file.exe
3232	file.exe
3232	file.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe
808	GoogleAppMonitor.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3232 wrote to memory of 5672	3232	file.exe	93
PID 3232 wrote to memory of 808	3232	file.exe	94
PID 808 wrote to memory of 4372	808	GoogleAppMonitor.exe	95
PID 808 wrote to memory of 1140	808	GoogleAppMonitor.exe	96
PID 808 wrote to memory of 5744	808	GoogleAppMonitor.exe	97
PID 808 wrote to memory of 3264	808	GoogleAppMonitor.exe	98
PID 808 wrote to memory of 5796	808	GoogleAppMonitor.exe	99
PID 808 wrote to memory of 5436	808	GoogleAppMonitor.exe	100

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3232
- C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe"
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleAppMonitor.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleAppMonitor.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe"
    3⤵
    - Executes dropped EXE
    PID:4372
- - C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe"
    3⤵
    - Executes dropped EXE
    PID:1140
- - C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe"
    3⤵
    - Executes dropped EXE
    PID:5744
- - C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe"
    3⤵
    - Executes dropped EXE
    PID:3264
- - C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe"
    3⤵
    - Executes dropped EXE
    PID:5796
- - C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleWebCache.exe"
    3⤵
    - Executes dropped EXE
    PID:5436

C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleSecureUpdate.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleSecureUpdate.exe" /user
1⤵
- Executes dropped EXE
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleSecureUpdate.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\GoogleSecureUpdate.exe
Size 25.9MB
SHA256 5679fad9147c523a5db5f2e3bf8bcbde8cf44baca6eb706ae30ff20fd306fe5f
MD5 b16cd3e21ddf8967f3e1c088a1cc9690
SHA1 6986cd5a97ae7969dfdc8288fb2476d344cbf1cd
SHA512 bf03e545a381d47f75b1a1513190242b8787699c997bec6ac2d8636a535d0a272033c34548348b191e725c1852a0e868e8e57d7085de47a3f8051c48bac6cb8a
SSDEEP 393216:ZsAJXnt1sNAvHpBocJn4pCu9AV3LFKiVLe+CqTWuQa+nY:ZF1t1swpKAxMAV3LFnVLe+CqTWra8Y
TLSH
T12A57B051F30B05F6FF434C3645F9AB2F7B39E2DC8974C55AE428242ABAA2C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chromebrowser.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\i3lvbiv4qw\chromebrowser.dll
Size 2.1MB
SHA256 2c0ae1b46be8dc0d88fc9fe0b181bc8a807d767976ca92604d5069bb6a5673e7
MD5 707b380f87c0a1efede84f58eef42dd4
SHA1 20d2358d905095a5f3a684ff197b7df0c81d2e76
SHA512 25088a64d7d05396570a641ab96828306f05f1499a69e04c711caeef428f2888c37d90fe001537887b0020db0a98055e689a6f7cd39132a3fd56d21fda25bfd8
SSDEEP 24576:JTCmwibnJvZCSaSBL08mhMosVWU63nbMdLIuAkCgclAuMBrW/2AQ:JOmnnJK2BRALgwMK2AQ
TLSH
T1FAA5D405F31715CFEF9541B06DBDB312EA5DCBA4A188CA779A5C827C3CB2C6E5884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/808-23-0x00007FF7D6690000-0x00007FF7D8030000-memory.dmp

Download

memory/1140-24-0x00007FF788C40000-0x00007FF78A5E0000-memory.dmp

Download

memory/2684-5-0x00007FF768E20000-0x00007FF76A7C0000-memory.dmp

Download

memory/3232-6-0x00007FF772B60000-0x00007FF774500000-memory.dmp

Download

memory/3232-19-0x00007FF772B60000-0x00007FF774500000-memory.dmp

Download

memory/3232-8-0x00007FF772B60000-0x00007FF774500000-memory.dmp

Download

memory/3232-2-0x00007FF772B60000-0x00007FF774500000-memory.dmp

Download

memory/3264-30-0x00007FF788C40000-0x00007FF78A5E0000-memory.dmp

Download

memory/4372-21-0x00007FF788C40000-0x00007FF78A5E0000-memory.dmp

Download

memory/5436-35-0x00007FF788C40000-0x00007FF78A5E0000-memory.dmp

Download

memory/5672-17-0x00007FF788C40000-0x00007FF78A5E0000-memory.dmp

Download

memory/5744-27-0x00007FF788C40000-0x00007FF78A5E0000-memory.dmp

Download

memory/5796-33-0x00007FF788C40000-0x00007FF78A5E0000-memory.dmp

Download