4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3

Analysis

max time kernel
147s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 13:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe
Size 25.6MB
Sample261027-qkn47adf49
SHA256 4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3
MD5 bfd573b26c4eaf5741b067a3b03a5c76
SHA1 c123e9b03c240c95ca7c82deaebaf0ea3306510b
SHA512 e7442f117884e3d1da708e49db3cb41e488fda7c273a729545acc3790c2604af431233a33e612d91907d62582f5e2c28daf4df4fdc7ce0b2df77bd80ca57e904
SSDEEP 196608:oYDUl4fm1oZ66vhhFUczpYm/ULNdEJOu3S//HFfEwDlezhUr6vfNbFpZBM2/iAst:oYDUWNZxPuAnULN+C3lsAlyhUrSfJZRW
TLSH
T19F47A051F30F05F6FF434C3645F9AB2F7B39E2DC8974C55AE428242ABAA2C1B459C291
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion miner persistence

Malware Config

Signatures

Fake Chrome/Google updater delivering miners 1 IoCs

miner defense_evasion

resource	yara_rule
behavioral2/files/0x0004000000000433-10.dat	fake_chrome_update

Executes dropped EXE 14 IoCs

pid	Process
5056	GoogleAppProcess.exe
1740	GoogleSessionManager.exe
1228	GoogleUpdateCenter.exe
4832	GoogleAppProcess.exe
1880	GoogleAppProcess.exe
2868	GoogleAppProcess.exe
2540	GoogleAppProcess.exe
3400	GoogleAppProcess.exe
1560	GoogleAppProcess.exe
1328	GoogleAppProcess.exe
2144	GoogleAppProcess.exe
3932	GoogleAppProcess.exe
4316	GoogleAppProcess.exe
3656	GoogleAppProcess.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\GUpdateBroker64 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\bc2o0l6c3z\\GoogleUpdateCenter.exe\" /user"	4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 5056	4812	4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe	90
PID 4812 wrote to memory of 1740	4812	4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe	91
PID 1740 wrote to memory of 4832	1740	GoogleSessionManager.exe	94
PID 1740 wrote to memory of 1880	1740	GoogleSessionManager.exe	95
PID 1740 wrote to memory of 2868	1740	GoogleSessionManager.exe	96
PID 1740 wrote to memory of 2540	1740	GoogleSessionManager.exe	97
PID 1740 wrote to memory of 3400	1740	GoogleSessionManager.exe	98
PID 1740 wrote to memory of 1560	1740	GoogleSessionManager.exe	99
PID 1740 wrote to memory of 1328	1740	GoogleSessionManager.exe	100
PID 1740 wrote to memory of 2144	1740	GoogleSessionManager.exe	101
PID 1740 wrote to memory of 3932	1740	GoogleSessionManager.exe	102
PID 1740 wrote to memory of 4316	1740	GoogleSessionManager.exe	103
PID 1740 wrote to memory of 3656	1740	GoogleSessionManager.exe	104

C:\Users\Admin\AppData\Local\Temp\4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe
"C:\Users\Admin\AppData\Local\Temp\4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleSessionManager.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleSessionManager.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:4832
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:1880
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2868
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2540
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:3400
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:1560
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:1328
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:2144
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:3932
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:4316
- - C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe"
    3⤵
    - Executes dropped EXE
    PID:3656

C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleUpdateCenter.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleUpdateCenter.exe" /user
1⤵
- Executes dropped EXE
PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleAppProcess.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\GoogleAppProcess.exe
Size 25.6MB
SHA256 4600b71b1eb1967c08212ba07fc0aa354400b31306e7d52af8a2329e592b4ff3
MD5 bfd573b26c4eaf5741b067a3b03a5c76
SHA1 c123e9b03c240c95ca7c82deaebaf0ea3306510b
SHA512 e7442f117884e3d1da708e49db3cb41e488fda7c273a729545acc3790c2604af431233a33e612d91907d62582f5e2c28daf4df4fdc7ce0b2df77bd80ca57e904
SSDEEP 196608:oYDUl4fm1oZ66vhhFUczpYm/ULNdEJOu3S//HFfEwDlezhUr6vfNbFpZBM2/iAst:oYDUWNZxPuAnULN+C3lsAlyhUrSfJZRW
TLSH
T19F47A051F30F05F6FF434C3645F9AB2F7B39E2DC8974C55AE428242ABAA2C1B459C291
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guagent.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\bc2o0l6c3z\guagent.dll
Size 2.1MB
SHA256 142452323d07b9518dc68cfddf2fbc5093e8a52946b1654dfadf05b74c4cdde2
MD5 4ea6c7537a8a5eadea526c5e3147c69a
SHA1 7b7f040524351bdd3872712ac493d5f4455f6abd
SHA512 08a475cec96b8358b1827e1acdcc05026739cd5719df845aea27c7aa01f5dad98420c886b61b567dbf08af57853a9fe0696785dedeb5a6dce7180f9e331ad79d
SSDEEP 24576:oJRrkCa3tc8kWNy/3FqvKBe0FJrp2srarAQ:ojrjado/Mbypb+rAQ
TLSH
T1CAA5D505F35715CFEF9541B06DBDB312EA5DCBA8A148CA779A5C827D3CB2C2E1884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1228-15-0x00007FF6110A0000-0x00007FF6129E3000-memory.dmp

Download

memory/1328-37-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/1560-34-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/1740-18-0x00007FF62C5E0000-0x00007FF62DF23000-memory.dmp

Download

memory/1880-22-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/2144-40-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/2540-28-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/2868-25-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/3400-31-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/3656-49-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/3932-43-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/4316-46-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/4812-2-0x00007FF75C400000-0x00007FF75DD43000-memory.dmp

Download

memory/4812-16-0x00007FF75C400000-0x00007FF75DD43000-memory.dmp

Download

memory/4812-4-0x00007FF75C400000-0x00007FF75DD43000-memory.dmp

Download

memory/4832-19-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

memory/5056-12-0x00007FF71DAE0000-0x00007FF71F423000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads