41e1ca8515fb9aad7333480c48b83ea0ac4bf070d7aa6b44995cf55106596d8d

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 21.4MB
Sample261022-ecm2dacv7j
SHA256 41e1ca8515fb9aad7333480c48b83ea0ac4bf070d7aa6b44995cf55106596d8d
MD5 672788c9307473e4e9b170b173b5b858
SHA1 4101fcb3639f3008451db4970d4dd393ef366292
SHA512 d01a734235b637f49fc284a5e3f2a7159062f684e8f67248ebae40f89d73717de852b9175f7e6bee32acbeed7eeab1229da06c1286c856f30cde3a2af8ae655f
SSDEEP 393216:PqgnVy/FRFiN3JTwhF2zaHejsHg5GWXKzK+fv:Px8/FR4wF2za+j9GIaK4v
TLSH
T1BC379E91B70F09F2FA475C3785F6AA2F3B76E1DC8DB0C559F4343856E29280A86EC191
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
4024	GoogleSearchUpdate.exe
4176	ChromeSearchRunner.exe
2948	ChromeWatchService.exe
2440	ChromeSearchRunner.exe
1572	ChromeSearchRunner.exe
5016	ChromeSearchRunner.exe
2336	ChromeSearchRunner.exe
836	ChromeSearchRunner.exe
4168	ChromeSearchRunner.exe
4696	ChromeSearchRunner.exe
4896	ChromeSearchRunner.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\GUpdateDaemon64 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\qrvwsdcou3\\GoogleSearchUpdate.exe\" /user"	file.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
2396	file.exe
2396	file.exe
2396	file.exe
2396	file.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe
2948	ChromeWatchService.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 4176	2396	file.exe	91
PID 2396 wrote to memory of 2948	2396	file.exe	92
PID 2948 wrote to memory of 2440	2948	ChromeWatchService.exe	93
PID 2948 wrote to memory of 1572	2948	ChromeWatchService.exe	94
PID 2948 wrote to memory of 5016	2948	ChromeWatchService.exe	95
PID 2948 wrote to memory of 2336	2948	ChromeWatchService.exe	96
PID 2948 wrote to memory of 836	2948	ChromeWatchService.exe	97
PID 2948 wrote to memory of 4168	2948	ChromeWatchService.exe	98
PID 2948 wrote to memory of 4696	2948	ChromeWatchService.exe	99
PID 2948 wrote to memory of 4896	2948	ChromeWatchService.exe	100

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
  2⤵
  - Executes dropped EXE
  PID:4176
- C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeWatchService.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeWatchService.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:2440
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:1572
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:5016
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:2336
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:836
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:4168
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:4696
- - C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\ChromeSearchRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:4896

C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\GoogleSearchUpdate.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\GoogleSearchUpdate.exe" /user
1⤵
- Executes dropped EXE
PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleSearchUpdate.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\GoogleSearchUpdate.exe
Size 21.4MB
SHA256 41e1ca8515fb9aad7333480c48b83ea0ac4bf070d7aa6b44995cf55106596d8d
MD5 672788c9307473e4e9b170b173b5b858
SHA1 4101fcb3639f3008451db4970d4dd393ef366292
SHA512 d01a734235b637f49fc284a5e3f2a7159062f684e8f67248ebae40f89d73717de852b9175f7e6bee32acbeed7eeab1229da06c1286c856f30cde3a2af8ae655f
SSDEEP 393216:PqgnVy/FRFiN3JTwhF2zaHejsHg5GWXKzK+fv:Px8/FR4wF2za+j9GIaK4v
TLSH
T1BC379E91B70F09F2FA475C3785F6AA2F3B76E1DC8DB0C559F4343856E29280A86EC191
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guupdate.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\qrvwsdcou3\guupdate.dll
Size 352KB
SHA256 9bb7f3c4495bd59fc2c1a1c70bae77a491bfa37f5d02f785bc71ecc56657c5db
MD5 0982302cf513fb4cb22c87deedc0a2df
SHA1 83b35363dea6f995af1a60c390072706ce3f22fa
SHA512 de393a444657c4222f664b6b539fd18e6900c3e3c440f3ffc527b54f988a83da3ae78fef77cfe5171b832e11b5c1c7d5709502846be6b7c4611c017e80b21cf5
SSDEEP 6144:sWNv0kmwjwj7g/VgoISHA1gu7m7nSIuci8anaT1CLdP4541GAQ:0kmwjwjUVgXSHASmJjCAQ
TLSH
T145742946B7831CCBEF65417519BDE322EA6DEBA45589CB23D5AC42392C33C6E5CC4382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/836-32-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/1572-23-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/2336-29-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/2396-7-0x00007FF641090000-0x00007FF6425B4000-memory.dmp

Download

memory/2396-18-0x00007FF641090000-0x00007FF6425B4000-memory.dmp

Download

memory/2396-2-0x00007FF641090000-0x00007FF6425B4000-memory.dmp

Download

memory/2396-5-0x00007FF641090000-0x00007FF6425B4000-memory.dmp

Download

memory/2440-20-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/2948-22-0x00007FF6A51E0000-0x00007FF6A6704000-memory.dmp

Download

memory/4024-4-0x00007FF64EA00000-0x00007FF64FF24000-memory.dmp

Download

memory/4168-35-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/4176-16-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/4696-38-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/4896-41-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download

memory/5016-26-0x00007FF668E10000-0x00007FF66A334000-memory.dmp

Download