fa9fe2e09ef917f1dde379d35f0c235f7b0b7c45aa4483d47e9f4b27ac8b61a8

Analysis

max time kernel
147s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 25.8MB
Sample261022-e4lydshy6x
SHA256 fa9fe2e09ef917f1dde379d35f0c235f7b0b7c45aa4483d47e9f4b27ac8b61a8
MD5 53ad22960ad6a620929ef40dc0341bc5
SHA1 6d0f8c7f5a298a57a85498c9a4eac1e40cb1a686
SHA512 6cf679a8a38ec0800d3190580c876db488739b0ad3fcab68842120ac47d24a82b05587e39f2499e0522895d4c78bfef5e6fed810f78de73819b69885025f34a0
SSDEEP 393216:3V5yq0QLoKWuNoHuWUuNr3TkTuOSYWFLUgb+gcqXtmL3z:FwQoLDDT7Y7gK7
TLSH
T18557AF51F30B05F6FF435C3645F9AB2F7B39E2DC89B4C556E828242ABA62C1B45CC291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
6036	GoogleUpdateTray.exe
6108	GoogleAppProcess.exe
3680	ChromeTaskChecker.exe
1868	GoogleAppProcess.exe
2896	GoogleAppProcess.exe
5636	GoogleAppProcess.exe
6056	GoogleAppProcess.exe
2772	GoogleAppProcess.exe
2132	GoogleAppProcess.exe
6052	GoogleAppProcess.exe
4696	GoogleAppProcess.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdAgent = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\9fb0ewuoop\\GoogleUpdateTray.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
3520	file.exe
3520	file.exe
3520	file.exe
3520	file.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe
3680	ChromeTaskChecker.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 6108	3520	file.exe	93
PID 3520 wrote to memory of 3680	3520	file.exe	94
PID 3680 wrote to memory of 1868	3680	ChromeTaskChecker.exe	95
PID 3680 wrote to memory of 2896	3680	ChromeTaskChecker.exe	96
PID 3680 wrote to memory of 5636	3680	ChromeTaskChecker.exe	97
PID 3680 wrote to memory of 6056	3680	ChromeTaskChecker.exe	98
PID 3680 wrote to memory of 2772	3680	ChromeTaskChecker.exe	99
PID 3680 wrote to memory of 2132	3680	ChromeTaskChecker.exe	100
PID 3680 wrote to memory of 6052	3680	ChromeTaskChecker.exe	101
PID 3680 wrote to memory of 4696	3680	ChromeTaskChecker.exe	102

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
  2⤵
  - Executes dropped EXE
  PID:6108
- C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\ChromeTaskChecker.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\ChromeTaskChecker.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3680
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:1868
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2896
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:5636
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:6056
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2772
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2132
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:6052
- - C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:4696

C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleUpdateTray.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleUpdateTray.exe" /user
1⤵
- Executes dropped EXE
PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdateTray.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\GoogleUpdateTray.exe
Size 25.8MB
SHA256 fa9fe2e09ef917f1dde379d35f0c235f7b0b7c45aa4483d47e9f4b27ac8b61a8
MD5 53ad22960ad6a620929ef40dc0341bc5
SHA1 6d0f8c7f5a298a57a85498c9a4eac1e40cb1a686
SHA512 6cf679a8a38ec0800d3190580c876db488739b0ad3fcab68842120ac47d24a82b05587e39f2499e0522895d4c78bfef5e6fed810f78de73819b69885025f34a0
SSDEEP 393216:3V5yq0QLoKWuNoHuWUuNr3TkTuOSYWFLUgb+gcqXtmL3z:FwQoLDDT7Y7gK7
TLSH
T18557AF51F30B05F6FF435C3645F9AB2F7B39E2DC89B4C556E828242ABA62C1B45CC291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmupdate.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\9fb0ewuoop\chrmupdate.dll
Size 2.2MB
SHA256 b7371e7db954ab21d1b792eef4b0cb4f53c00724bb5acf1eb2056d91758edffd
MD5 e13af2bbdb6b32397c8c3b9151268a71
SHA1 23c0f3f915dabe5f79d0b6032ae1d62e990f7d05
SHA512 9afc39aed3eb84728f93118fcd770aae7d7e5953e2b78c7980c196071e11167364bf5416b560daa6e6b02ed47c781c6eb738c28cada49a20263e9d673fb31132
SSDEEP 24576:JsYTNLdySP9FtMZyHdl/HsBjh4YOFy4y5KJIBK3KqpAQ:Jb/v6go4BFx9T/pAQ
TLSH
T17FB5D505F75715CFEF5581B06DBDA312EA5DCBA4A08CCA779A5C827C3CB2C2E1884396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1868-20-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/2132-35-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/2772-32-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/2896-23-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/3520-7-0x00007FF6911D0000-0x00007FF692B51000-memory.dmp

Download

memory/3520-14-0x00007FF6911D0000-0x00007FF692B51000-memory.dmp

Download

memory/3520-2-0x00007FF6911D0000-0x00007FF692B51000-memory.dmp

Download

memory/3520-6-0x00007FF6911D0000-0x00007FF692B51000-memory.dmp

Download

memory/3680-21-0x00007FF71DCD0000-0x00007FF71F651000-memory.dmp

Download

memory/4696-41-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/5636-26-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/6036-5-0x00007FF6BCE60000-0x00007FF6BE7E1000-memory.dmp

Download

memory/6052-38-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/6056-29-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download

memory/6108-16-0x00007FF794FA0000-0x00007FF796921000-memory.dmp

Download