2d0233e6312ee6900861829d764b4da0ef5194b5f6856aa322c171748aa7a8d0

Resubmissions

24/10/2026, 18:12

261024-ws9zhswtav7

24/10/2026, 18:10

261024-wscn1s1t2l7

Analysis

user interaction
yes
max time kernel
44s
max time network
41s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cryservice.gg.exe
Size 13.4MB
Sample261024-ws9zhswtav
SHA256 2d0233e6312ee6900861829d764b4da0ef5194b5f6856aa322c171748aa7a8d0
MD5 1a71285fc3cb077408c47accf9ea4f6b
SHA1 f9a1a5a4854ae9ea9ccb248b3dca72d51d98785c
SHA512 f855f2698a9db327fed659b6d26ea5a5587bf73463dd8b492760fdfb7948149080c577ca8376a7743aa493b8e20d936ff35c1f994fe0c6e7700f279902fcfd26
SSDEEP 98304:4OpUddvPzSJ4FpDyxZVgqLSHHln0FOyq4H+uJsOwsE1LIIBnc2642o7lfthXBNOT:45PveMxHln0bq0+uJs1Lnc264f7ltNo
TLSH
T13BE6BE06B2A481F9D26790389997A607FB717405072087DB33EC4AA95FB7BE05EBF311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
1340	cloud_chk.exe
3180	cloud_chk2.exe
4612	cloud_chk.exe
3740	cloud_chk2.exe
1360	cloud_chk2.exe
4832	cloud_chk.exe
1496	cloud_chk.exe
3440	cloud_chk2.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	discord.com
12	discord.com
13	discord.com
17	discord.com
21	discord.com
22	discord.com
27	discord.com
1	discord.com

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cloud_chk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cloud_chk2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cloud_chk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cloud_chk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cloud_chk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cloud_chk2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cloud_chk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cloud_chk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cloud_chk.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cloud_chk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 1340	3804	cryservice.gg.exe	81
PID 3804 wrote to memory of 3180	3804	cryservice.gg.exe	82
PID 1208 wrote to memory of 4612	1208	cryservice.gg.exe	91
PID 1208 wrote to memory of 3740	1208	cryservice.gg.exe	92
PID 2532 wrote to memory of 4832	2532	cryservice.gg.exe	97
PID 2532 wrote to memory of 1360	2532	cryservice.gg.exe	98
PID 4172 wrote to memory of 1496	4172	cryservice.gg.exe	102
PID 4172 wrote to memory of 3440	4172	cryservice.gg.exe	103

C:\Users\Admin\AppData\Local\Temp\cryservice.gg.exe
"C:\Users\Admin\AppData\Local\Temp\cryservice.gg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:1340
- C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:3180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3964

C:\Users\Admin\AppData\Local\Temp\cryservice.gg.exe
"C:\Users\Admin\AppData\Local\Temp\cryservice.gg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4612
- C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe"
  2⤵
  - Executes dropped EXE
  PID:3740

C:\Users\Admin\Desktop\cryservice.gg.exe
"C:\Users\Admin\Desktop\cryservice.gg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:4832
- C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe"
  2⤵
  - Executes dropped EXE
  PID:1360

C:\Users\Admin\Desktop\cryservice.gg.exe
"C:\Users\Admin\Desktop\cryservice.gg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4172
- C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe
  "C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe"
  2⤵
  - Executes dropped EXE
  PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

launcher.ini

Path C:\Users\Admin\AppData\Local\Cry Services\launcher.ini
Size 279B
SHA256 a8e271ec68e44a01ffddf63ff5a12b29b158237a80934ad357686b8f63074179
MD5 4513c7500365cfd92ef64877c542a51f
SHA1 6cb8606ac89fb420bea0fa95bec73140c3427875
SHA512 c38135a63f1ceab4d036ec7f15239f775281aa6e783e56c9bd8ae7ee9f32c4b55ce71ec2a0ff9e4bc95059675cb5a90e23eeafdfa829b942a68a8be5ce2bbfab
TLSH
T1DAD0C242B585A55A49E9B2A12DE802B8B8E00D0006A2246009608C2F2D6688BB3A8247
MD5 SHA1 SHA512 TLSH

Submit Download

chromium_harvest.log

Path C:\Users\Admin\AppData\Local\Temp\chromium_harvest.log
Size 2KB
SHA256 059a1695f137ddf156b55783f991fa9b438af3b5ed3f7f2f3db7df224bbfff0e
MD5 b4df4057f654bde161a726a8ce16d92f
SHA1 4c73c08fc3087869daa945cfbb977b6a01391ad4
SHA512 aff2a92d1a426c55f7d7957324812997ad1fd3f606bbc0a171521710701253e93e82d0d69d763c05c5fb439d09bee2a8afd8014a99472cd85256e862560cc2b8
TLSH
T19D51F8049FE88468B9779E439DB36A165EB3B9465834F91D2498420C0BB7E8ED03833F
MD5 SHA1 SHA512 TLSH

Submit Download

chromium_harvest.log

Path C:\Users\Admin\AppData\Local\Temp\chromium_harvest.log
Size 2KB
SHA256 de725fdb8074ef932be8703d8c78f5b6ef35d6a42778455cb0d2c9535be16965
MD5 100f1b3427a2ad84c5138426dca97d96
SHA1 e34e78a36acc583a62c213ca50ac0f1b6319d569
SHA512 f86e099771f6d44406ea7d6d0e51136ab24eb5d9c74c7649774dc6f86e68ae4ff02b97f1e64a3e79e848d4ae89a746d6d41d8e7878257c1988ebf02d9206f488
TLSH
T1825108049FE88468B9779E439DB36A165EB3B8465834E91D2598520C0BB7E8ED03833F
MD5 SHA1 SHA512 TLSH

Submit Download

chromium_harvest.log

Path C:\Users\Admin\AppData\Local\Temp\chromium_harvest.log
Size 294B
SHA256 fa03da54276f657bc6e9f752d99ab2f08a67b8fcb50879ded908c027f3ef7dcb
MD5 5ed9d9684ede831b4855dbd469dcb128
SHA1 bf33a8fd9d9f88e65f7b34fcee425476d743427f
SHA512 1aab6bdd0ef5c3f8653940ff52731b03b57f0aa053854be1c8729a05eb48e353662fe071c3188c61c4929fe4c1d7ebbe7b24846d65781c117b706076f8cf9582
TLSH
T1BDE067888FE880697977EA835D7369111F72B9525435E81C35986A0D06B3949A42432E
MD5 SHA1 SHA512 TLSH

Submit Download

chromium_harvest.log

Path C:\Users\Admin\AppData\Local\Temp\chromium_harvest.log
Size 1KB
SHA256 58969819377f77460e3a04df002bf8485683bce3317d8ddb289592a5c156a85f
MD5 827428d6071bee888c20617069ca29c7
SHA1 5a7c3faae1e48bf244d3d3017b58cc74e18ca8d7
SHA512 03cdb7f12f8e64c2acd3e35daeae990f31bf8b8a6830d610d7bb17ef3161e721b766751a5d29f7d99eb34875b3653a878dff4fe53529bf429cfab32646b58c2a
TLSH
T17E3117485FE84468B87B9E439DB36A165FB3B8461834E90C34D8560C0BB3E8AD17833F
MD5 SHA1 SHA512 TLSH

Submit Download

chromium_harvest.log

Path C:\Users\Admin\AppData\Local\Temp\chromium_harvest.log
Size 2KB
SHA256 5d15ac095181201a07ed337947e123788216294eb0eab04c2522f6a34a5dd0fb
MD5 9ce17de2e4ff482a51d756432cffbc00
SHA1 7aaf808ea76aaf1f7a8fa4111d104f16caf2d67f
SHA512 306f6181cba6b29949aba8b7e27c5b9fc553e0ce622a3f61e54462241acfb38aba2d8061ff455a824c500b0ab77bc58b9c31ff008d7bba693938c4d9bdb389c7
TLSH
T1524108045FE84468B9779E439DB36A165EB3B8465838E91D24D8560C0BB7E8ED03833F
MD5 SHA1 SHA512 TLSH

Submit Download

chromium_harvest.log

Path C:\Users\Admin\AppData\Local\Temp\chromium_harvest.log
Size 1KB
SHA256 e5f50e454edcb6795d168268f7bd0fc59fb6df77cc9f86f1191ff5559e2547ff
MD5 32522b08716947ba060809cebf1454d3
SHA1 0241e0af543c213726caf00e3ba0806af884b117
SHA512 283c34144332b059de0c13c597d0fb5a6f3eb4db6d77c017008fc9f5eb4f90beadf1ba5a51ad839d8b79e98cb3b93a01186c5c669a15a571a4688a5b6766be3f
TLSH
T10D410A485FEC8468B9779A435DB36A165FB3B8465834E90D25D8560C0BB7E8AD03833F
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_chk.exe

Path C:\Users\Admin\AppData\Local\Temp\cloud_chk.exe
Size 93KB
SHA256 14eb18ed968608e26cb0f5f1c683bf745a7109de0f39e3f5c7c8a1a5f02ee7e7
MD5 8888de84918b2e35a65e274a4dcf3f44
SHA1 af8508a4e43f94b2a897d14f28d00d0e2042d9a0
SHA512 75700aec84cb8e27b623d1b160773ce815ba172f83f4a945ffa1fd376b05cacc807c7a28d67478800f1425cb7a438f0464cd97129c2032ef0f7f549848d706c6
SSDEEP 1536:33osymTGq3UiHiU1LLXUyK+oAYFR1KfiWiG9VSNEAW1Yxdxb:3EmqQUiL1LLXUyKdAOR1KftiwSqnWxdZ
TLSH
T132934C27DA1940AED25AD5FCDA834801DF72BC8607A1B7CF53915DE20E26AD85F3F602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_chk2.exe

Path C:\Users\Admin\AppData\Local\Temp\cloud_chk2.exe
Size 164KB
SHA256 0094914c62d5138c99cb00af0e0ce0049be4c24536ec26880d9221a4dde8a5a6
MD5 f00a176a529ddda392df2203cb268fd2
SHA1 a0548197e4918487f8c0eab37dfe28c8737485d0
SHA512 9caf4a4cfd72cc0c9c172088f09ddbfc9631992c72fcf45321cdd0dbf7dd68a41c8a8033098f30c52afcd009359c352a5f2f17981b5dee9285237268f677d418
SSDEEP 3072:sl9GJkyb3nwffo2Fl8jg6G3xLTP4A7D9bVFHC:sKJNb3wftFl8jg6GBLTPX73RC
TLSH
T17BF33B26B91800BDD276C5B8DE965C02FB717C8A0775AEDF07905AB20E275D49F3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads