29c6ce08735e64fc22d5dbb22cbb65ac2cee03f79c6fb9d82cc820dd9a7af572

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 25.9MB
Sample261022-ca9q9ahs4y
SHA256 29c6ce08735e64fc22d5dbb22cbb65ac2cee03f79c6fb9d82cc820dd9a7af572
MD5 a07143d2b2fed021918eea24b59b79e8
SHA1 a937808e6bbdef308f869eb799f8a67128e6a047
SHA512 3d5c79ec4ea9cbc81095cafab5e1ab558d0c6ee6b0b0028c06aa6659d941f5cf54f0a0454a18aeb9149823f411392d664fee14e125b4527af6539e2301abaaf2
SSDEEP 393216:EBI3AVv798sbti8688pME8r07T6+kmD/8qnHAwFDm1:EBUsvAp40q+kmDBHfY
TLSH
T1B757B051F30B05F6FB435C3645F9AB2F7B3AE2DC8874C556E828242ABA63C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
248	GoogleBrowserProcess.exe
2092	GoogleBackgroundProcess.exe
5940	ChromeWatchService.exe
5848	GoogleBackgroundProcess.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdHelper = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\kuqzqg880a\\GoogleBrowserProcess.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5800	file.exe
5800	file.exe
5800	file.exe
5800	file.exe
5940	ChromeWatchService.exe
5940	ChromeWatchService.exe
5940	ChromeWatchService.exe
5940	ChromeWatchService.exe
5940	ChromeWatchService.exe
5940	ChromeWatchService.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 2092	5800	file.exe	92
PID 5800 wrote to memory of 5940	5800	file.exe	93
PID 5940 wrote to memory of 5848	5940	ChromeWatchService.exe	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBackgroundProcess.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBackgroundProcess.exe"
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\ChromeWatchService.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\ChromeWatchService.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBackgroundProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBackgroundProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:5848

C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBrowserProcess.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBrowserProcess.exe" /user
1⤵
- Executes dropped EXE
PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleBackgroundProcess.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBackgroundProcess.exe
Size 15.6MB
SHA256 e87ba85d8ec6cdc865b75cb36881be2a2df71f7e0bf163c6591dc8103e127b66
MD5 90691f678a84de480f407dc70a79fe44
SHA1 ff2b626992597f7ab26eeff972e136cdb109e10e
SHA512 68fa2633a9e81c20425069683b0b25166ed0b07b54263d91123adb1b81f273cf521d1fb623095d1d9bc1cd6f60d9b9aa3d1c28ebb40bd94e94f94ad3f995baa2
SSDEEP 196608:EBd+z35QGE5XYefX3SyeGIC8G95bEvgHCK:EBI3AVv798sbtiK
TLSH
T110F65D51B30F05F2FB435C3645F9AB2F7F36E2DC8974C559E828242AB6A2C1B85DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GoogleBrowserProcess.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\GoogleBrowserProcess.exe
Size 25.9MB
SHA256 29c6ce08735e64fc22d5dbb22cbb65ac2cee03f79c6fb9d82cc820dd9a7af572
MD5 a07143d2b2fed021918eea24b59b79e8
SHA1 a937808e6bbdef308f869eb799f8a67128e6a047
SHA512 3d5c79ec4ea9cbc81095cafab5e1ab558d0c6ee6b0b0028c06aa6659d941f5cf54f0a0454a18aeb9149823f411392d664fee14e125b4527af6539e2301abaaf2
SSDEEP 393216:EBI3AVv798sbti8688pME8r07T6+kmD/8qnHAwFDm1:EBUsvAp40q+kmDBHfY
TLSH
T1B757B051F30B05F6FB435C3645F9AB2F7B3AE2DC8874C556E828242ABA63C1B45DC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gubroker.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\kuqzqg880a\gubroker.dll
Size 2.2MB
SHA256 bcfc4ce1db4eafbed3d1ccacc1715e9de72622c99abc99fc3c15276163b91b31
MD5 218f816f676cc4c3a4b8a6ce7dde2d4c
SHA1 cd7e52107334bf1dbe3ac449800b0944fe8254fb
SHA512 94d973f06646300d5a3ae2ac1692df3cc4dc682d9f1487f3ebd4f5f598c1dc17bec50afcf84c2b4d83c7006af7bcc4df94ddd0b3ec8fe1b51e8077f245dd94df
SSDEEP 24576:V3dbXhx6izeAlLo6C+PGx/avRK6nIzpR7tcsjpClJz8HAQ:VRXzfEmG4RKQELJjpCcHAQ
TLSH
T195B5D505F35715CFEF9581B06D7DB712EA5DCBA4A188CA379A5C827C3CB2C6E1884386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-5-0x00007FF629310000-0x00007FF62ACA6000-memory.dmp

Download

memory/2092-20-0x00007FF76CB50000-0x00007FF76E4E6000-memory.dmp

Download

memory/5800-2-0x00007FF649890000-0x00007FF64B226000-memory.dmp

Download

memory/5800-6-0x00007FF649890000-0x00007FF64B226000-memory.dmp

Download

memory/5800-8-0x00007FF649890000-0x00007FF64B226000-memory.dmp

Download

memory/5848-23-0x00007FF76CB50000-0x00007FF76E4E6000-memory.dmp

Download