gcleaner | 3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/10/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe
Size 1.2MB
Sample261031-aa3xlahs8n
SHA256 3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2
MD5 7a77d61135bd13e07009198cb6e5974a
SHA1 57c5682efff6d39ece4c4f822ae8af0c23a0590b
SHA512 41059a083a3d11453b6ad4a046f24fabf73fffa53fd4db201e81d77a0445976e3df14dc890d040527cbda8ab86d63ccca510dd60d5a41b189a2f347a579d8770
SSDEEP 24576:qMaUsoLTepLynuRbIiammvXHkwwxP9JOUOBhdD46nh/FaD0J9h:qRUsUP2Smmv3XPBhuqh9k+
TLSH
T1EC457D32B291C43BD5B3163CDD2AA29994267D101D3D884F7EE85F4C1F39A813F6A297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution gcleaner loader persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

gcleaner

185.156.73.98

Signatures

Family: GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 5240 created 2140	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	80

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	oh8TLgcTrzl6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chromeupdate.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2776	powershell.exe
2248	powershell.exe
2776	powershell.exe
2248	powershell.exe

Downloads MZ/PE file 30 IoCs

flow	pid	Process
12	4248	svchost.exe
12	4248	svchost.exe
12	4248	svchost.exe
12	4248	svchost.exe
12	4248	svchost.exe
12	4248	svchost.exe
12	4248	svchost.exe
12	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
13	4248	svchost.exe
20	4248	svchost.exe
20	4248	svchost.exe

Executes dropped EXE 30 IoCs

pid	Process
4372	N9VQkX8D6bRx.exe
1588	Vqdq4dGSxm6KR.exe
3416	YguufIJeWyxa6.exe
2388	oh8TLgcTrzl6.exe
3596	y4Zv6QUqfGH.exe
1188	plkAKPuwNTS.exe
4448	goswtyd8mvz.exe
5112	Exqq8L8SE.exe
1052	IdCevKVRZM.exe
2144	C23wpMzbutmO.exe
3012	uE78wQ58P.exe
5612	uJ5S9rst3.exe
4700	sjmNggNMmqs.exe
3852	VdMZMDXWI.exe
5392	GXHwuascTyYg.exe
4320	PYOPbjO8UM2.exe
4516	rE5ST1us4.exe
2988	K9MxRtrzqcRRY.exe
4272	pM9W0hsuNVKL.exe
5696	KFelOvDlnqCa.exe
4652	chromeupdate.exe
2136	p6SIl4rnJN.exe
2584	chromeupdate.exe
3272	ANp88vGMo8qzD.exe
2164	9PyCSNRX5VaQ.exe
3264	EvRZFetpcjQpv.exe
5944	VtkQQM5GdZQ.exe
3756	sQHnKIfWw6d.exe
1260	o56786sgodKfE.exe
5648	qbsoPshE0wO.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Wine	oh8TLgcTrzl6.exe
Key opened	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Wine	chromeupdate.exe

Loads dropped DLL 1 IoCs

pid	Process
4700	sjmNggNMmqs.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\617714F52EA6B0EB2146BC507EF8A6E5_FileGrabber\data\Downloads\desktop.ini	chromeupdate.exe
File created	C:\Users\Admin\AppData\Local\Temp\617714F52EA6B0EB2146BC507EF8A6E5_FileGrabber\data\Desktop\desktop.ini	chromeupdate.exe
File created	C:\Users\Admin\AppData\Local\Temp\617714F52EA6B0EB2146BC507EF8A6E5_FileGrabber\data\Documents\desktop.ini	chromeupdate.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5240 set thread context of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\chromeupdate\chromeupdate.exe	oh8TLgcTrzl6.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5888	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chromeupdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chromeupdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sjmNggNMmqs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sjmNggNMmqs.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qbsoPshE0wO.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chromeupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chromeupdate.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3060	timeout.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe
5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe
4700	sjmNggNMmqs.exe
4700	sjmNggNMmqs.exe
4700	sjmNggNMmqs.exe
4700	sjmNggNMmqs.exe
4700	sjmNggNMmqs.exe
4700	sjmNggNMmqs.exe
2388	oh8TLgcTrzl6.exe
2388	oh8TLgcTrzl6.exe
2776	powershell.exe
2776	powershell.exe
4652	chromeupdate.exe
4652	chromeupdate.exe
2248	powershell.exe
2248	powershell.exe
4652	chromeupdate.exe
4652	chromeupdate.exe
4652	chromeupdate.exe
4652	chromeupdate.exe
4652	chromeupdate.exe
4652	chromeupdate.exe
4652	chromeupdate.exe
4652	chromeupdate.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeIncreaseQuotaPrivilege	2776	powershell.exe
Token: SeSecurityPrivilege	2776	powershell.exe
Token: SeTakeOwnershipPrivilege	2776	powershell.exe
Token: SeLoadDriverPrivilege	2776	powershell.exe
Token: SeSystemProfilePrivilege	2776	powershell.exe
Token: SeSystemtimePrivilege	2776	powershell.exe
Token: SeProfSingleProcessPrivilege	2776	powershell.exe
Token: SeIncBasePriorityPrivilege	2776	powershell.exe
Token: SeCreatePagefilePrivilege	2776	powershell.exe
Token: SeBackupPrivilege	2776	powershell.exe
Token: SeRestorePrivilege	2776	powershell.exe
Token: SeShutdownPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeSystemEnvironmentPrivilege	2776	powershell.exe
Token: SeRemoteShutdownPrivilege	2776	powershell.exe
Token: SeUndockPrivilege	2776	powershell.exe
Token: SeManageVolumePrivilege	2776	powershell.exe
Token: 33	2776	powershell.exe
Token: 34	2776	powershell.exe
Token: 35	2776	powershell.exe
Token: 36	2776	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeIncreaseQuotaPrivilege	2248	powershell.exe
Token: SeSecurityPrivilege	2248	powershell.exe
Token: SeTakeOwnershipPrivilege	2248	powershell.exe
Token: SeLoadDriverPrivilege	2248	powershell.exe
Token: SeSystemProfilePrivilege	2248	powershell.exe
Token: SeSystemtimePrivilege	2248	powershell.exe
Token: SeProfSingleProcessPrivilege	2248	powershell.exe
Token: SeIncBasePriorityPrivilege	2248	powershell.exe
Token: SeCreatePagefilePrivilege	2248	powershell.exe
Token: SeBackupPrivilege	2248	powershell.exe
Token: SeRestorePrivilege	2248	powershell.exe
Token: SeShutdownPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeSystemEnvironmentPrivilege	2248	powershell.exe
Token: SeRemoteShutdownPrivilege	2248	powershell.exe
Token: SeUndockPrivilege	2248	powershell.exe
Token: SeManageVolumePrivilege	2248	powershell.exe
Token: 33	2248	powershell.exe
Token: 34	2248	powershell.exe
Token: 35	2248	powershell.exe
Token: 36	2248	powershell.exe
Token: SeDebugPrivilege	4652	chromeupdate.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 5240 wrote to memory of 4248	5240	3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe	89
PID 4248 wrote to memory of 4372	4248	svchost.exe	90
PID 4248 wrote to memory of 1588	4248	svchost.exe	92
PID 4248 wrote to memory of 3416	4248	svchost.exe	94
PID 4248 wrote to memory of 2388	4248	svchost.exe	96
PID 4248 wrote to memory of 3596	4248	svchost.exe	98
PID 4248 wrote to memory of 1188	4248	svchost.exe	100
PID 4248 wrote to memory of 4448	4248	svchost.exe	102
PID 4248 wrote to memory of 5112	4248	svchost.exe	104
PID 4248 wrote to memory of 1052	4248	svchost.exe	106
PID 4248 wrote to memory of 2144	4248	svchost.exe	108
PID 4248 wrote to memory of 3012	4248	svchost.exe	110
PID 4248 wrote to memory of 5612	4248	svchost.exe	112
PID 4248 wrote to memory of 4700	4248	svchost.exe	114
PID 4248 wrote to memory of 3852	4248	svchost.exe	115
PID 4248 wrote to memory of 5392	4248	svchost.exe	117
PID 4248 wrote to memory of 4320	4248	svchost.exe	119
PID 4248 wrote to memory of 4516	4248	svchost.exe	121
PID 4248 wrote to memory of 2988	4248	svchost.exe	123
PID 4248 wrote to memory of 4272	4248	svchost.exe	125
PID 4248 wrote to memory of 5696	4248	svchost.exe	127
PID 2388 wrote to memory of 2776	2388	oh8TLgcTrzl6.exe	129
PID 2388 wrote to memory of 4652	2388	oh8TLgcTrzl6.exe	132
PID 2388 wrote to memory of 5888	2388	oh8TLgcTrzl6.exe	133
PID 5888 wrote to memory of 3060	5888	cmd.exe	135
PID 4248 wrote to memory of 2136	4248	svchost.exe	136
PID 4248 wrote to memory of 3272	4248	svchost.exe	140
PID 4248 wrote to memory of 2164	4248	svchost.exe	142
PID 4248 wrote to memory of 3264	4248	svchost.exe	144
PID 4248 wrote to memory of 5944	4248	svchost.exe	146
PID 4248 wrote to memory of 3756	4248	svchost.exe	148
PID 4248 wrote to memory of 1260	4248	svchost.exe	150
PID 4248 wrote to memory of 5648	4248	svchost.exe	152
PID 4652 wrote to memory of 2248	4652	chromeupdate.exe	154

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
PID:2140
- C:\Users\Admin\AppData\Local\Temp\3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe
  "C:\Users\Admin\AppData\Local\Temp\3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5240
- C:\Windows\SysWOW64\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\3d0f1bce791377997266a1426a514eb2304ebe44cbad21dc2b8bbbb90ba060a2.exe"
  2⤵
  - Downloads MZ/PE file
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Users\Admin\AppData\Roaming\vKtfqj4\N9VQkX8D6bRx.exe
    "C:\Users\Admin\AppData\Roaming\vKtfqj4\N9VQkX8D6bRx.exe"
    3⤵
    - Executes dropped EXE
    PID:4372
- - C:\Users\Admin\AppData\Roaming\sfdS2s\Vqdq4dGSxm6KR.exe
    "C:\Users\Admin\AppData\Roaming\sfdS2s\Vqdq4dGSxm6KR.exe"
    3⤵
    - Executes dropped EXE
    PID:1588
- - C:\Users\Admin\AppData\Roaming\MuO4XK\YguufIJeWyxa6.exe
    "C:\Users\Admin\AppData\Roaming\MuO4XK\YguufIJeWyxa6.exe"
    3⤵
    - Executes dropped EXE
    PID:3416
- - C:\Users\Admin\AppData\Roaming\kFhVwXt3\oh8TLgcTrzl6.exe
    "C:\Users\Admin\AppData\Roaming\kFhVwXt3\oh8TLgcTrzl6.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\chromeupdate' -ExclusionProcess 'chromeupdate.exe' -ExclusionExtension '.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2776
  - - C:\Windows\chromeupdate\chromeupdate.exe
      "C:\Windows\chromeupdate\chromeupdate.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Executes dropped EXE
      Identifies Wine through registry keys
      Drops desktop.ini file(s)
      Reads the TCP/IP host and domain name from the registry
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\chromeupdate' -ExclusionProcess 'chromeupdate.exe' -ExclusionExtension '.exe'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2248
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c timeout /t 3 /nobreak > nul & del /f /q "C:\Users\Admin\AppData\Roaming\kFhVwXt3\oh8TLgcTrzl6.exe" & rmdir "C:\Users\Admin\AppData\Roaming\kFhVwXt3"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5888
    - - C:\Windows\system32\timeout.exe
        
        timeout /t 3 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:3060
- - C:\Users\Admin\AppData\Roaming\EUpIh8AE\y4Zv6QUqfGH.exe
    "C:\Users\Admin\AppData\Roaming\EUpIh8AE\y4Zv6QUqfGH.exe"
    3⤵
    - Executes dropped EXE
    PID:3596
- - C:\Users\Admin\AppData\Roaming\C6vsATH\plkAKPuwNTS.exe
    "C:\Users\Admin\AppData\Roaming\C6vsATH\plkAKPuwNTS.exe"
    3⤵
    - Executes dropped EXE
    PID:1188
- - C:\Users\Admin\AppData\Roaming\6VHPCCX8UI\goswtyd8mvz.exe
    "C:\Users\Admin\AppData\Roaming\6VHPCCX8UI\goswtyd8mvz.exe"
    3⤵
    - Executes dropped EXE
    PID:4448
- - C:\Users\Admin\AppData\Roaming\uT9rLJaA6K\Exqq8L8SE.exe
    "C:\Users\Admin\AppData\Roaming\uT9rLJaA6K\Exqq8L8SE.exe"
    3⤵
    - Executes dropped EXE
    PID:5112
- - C:\Users\Admin\AppData\Roaming\i5nSmdTTu\IdCevKVRZM.exe
    "C:\Users\Admin\AppData\Roaming\i5nSmdTTu\IdCevKVRZM.exe"
    3⤵
    - Executes dropped EXE
    PID:1052
- - C:\Users\Admin\AppData\Roaming\gKfCy5Ty\C23wpMzbutmO.exe
    "C:\Users\Admin\AppData\Roaming\gKfCy5Ty\C23wpMzbutmO.exe"
    3⤵
    - Executes dropped EXE
    PID:2144
- - C:\Users\Admin\AppData\Roaming\P8KMlqea\uE78wQ58P.exe
    "C:\Users\Admin\AppData\Roaming\P8KMlqea\uE78wQ58P.exe"
    3⤵
    - Executes dropped EXE
    PID:3012
- - C:\Users\Admin\AppData\Roaming\DXcwSLtTfbZ\uJ5S9rst3.exe
    "C:\Users\Admin\AppData\Roaming\DXcwSLtTfbZ\uJ5S9rst3.exe"
    3⤵
    - Executes dropped EXE
    PID:5612
- - C:\Users\Admin\AppData\Roaming\rvNkpVKKPs\sjmNggNMmqs.exe
    "C:\Users\Admin\AppData\Roaming\rvNkpVKKPs\sjmNggNMmqs.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4700
- - C:\Users\Admin\AppData\Roaming\L07DRvFVL6\VdMZMDXWI.exe
    "C:\Users\Admin\AppData\Roaming\L07DRvFVL6\VdMZMDXWI.exe"
    3⤵
    - Executes dropped EXE
    PID:3852
- - C:\Users\Admin\AppData\Roaming\njXrG9MYx\GXHwuascTyYg.exe
    "C:\Users\Admin\AppData\Roaming\njXrG9MYx\GXHwuascTyYg.exe"
    3⤵
    - Executes dropped EXE
    PID:5392
- - C:\Users\Admin\AppData\Roaming\dMlNnaKsz\PYOPbjO8UM2.exe
    "C:\Users\Admin\AppData\Roaming\dMlNnaKsz\PYOPbjO8UM2.exe"
    3⤵
    - Executes dropped EXE
    PID:4320
- - C:\Users\Admin\AppData\Roaming\KoMcY\rE5ST1us4.exe
    "C:\Users\Admin\AppData\Roaming\KoMcY\rE5ST1us4.exe"
    3⤵
    - Executes dropped EXE
    PID:4516
- - C:\Users\Admin\AppData\Roaming\Gqq82IZdNQL\K9MxRtrzqcRRY.exe
    "C:\Users\Admin\AppData\Roaming\Gqq82IZdNQL\K9MxRtrzqcRRY.exe"
    3⤵
    - Executes dropped EXE
    PID:2988
- - C:\Users\Admin\AppData\Roaming\8y7FTbOgr7X\pM9W0hsuNVKL.exe
    "C:\Users\Admin\AppData\Roaming\8y7FTbOgr7X\pM9W0hsuNVKL.exe"
    3⤵
    - Executes dropped EXE
    PID:4272
- - C:\Users\Admin\AppData\Roaming\q2p6MQjQlh\KFelOvDlnqCa.exe
    "C:\Users\Admin\AppData\Roaming\q2p6MQjQlh\KFelOvDlnqCa.exe"
    3⤵
    - Executes dropped EXE
    PID:5696
- - C:\Users\Admin\AppData\Roaming\slAkSoZiK9\p6SIl4rnJN.exe
    "C:\Users\Admin\AppData\Roaming\slAkSoZiK9\p6SIl4rnJN.exe"
    3⤵
    - Executes dropped EXE
    PID:2136
- - C:\Users\Admin\AppData\Roaming\xWVDppOlV\ANp88vGMo8qzD.exe
    "C:\Users\Admin\AppData\Roaming\xWVDppOlV\ANp88vGMo8qzD.exe"
    3⤵
    - Executes dropped EXE
    PID:3272
- - C:\Users\Admin\AppData\Roaming\bvjioTko4\9PyCSNRX5VaQ.exe
    "C:\Users\Admin\AppData\Roaming\bvjioTko4\9PyCSNRX5VaQ.exe"
    3⤵
    - Executes dropped EXE
    PID:2164
- - C:\Users\Admin\AppData\Roaming\pCEaGYrr\EvRZFetpcjQpv.exe
    "C:\Users\Admin\AppData\Roaming\pCEaGYrr\EvRZFetpcjQpv.exe"
    3⤵
    - Executes dropped EXE
    PID:3264
- - C:\Users\Admin\AppData\Roaming\7anc370Oszr\VtkQQM5GdZQ.exe
    "C:\Users\Admin\AppData\Roaming\7anc370Oszr\VtkQQM5GdZQ.exe"
    3⤵
    - Executes dropped EXE
    PID:5944
- - C:\Users\Admin\AppData\Roaming\W63uYzSIHlL\sQHnKIfWw6d.exe
    "C:\Users\Admin\AppData\Roaming\W63uYzSIHlL\sQHnKIfWw6d.exe"
    3⤵
    - Executes dropped EXE
    PID:3756
- - C:\Users\Admin\AppData\Roaming\TnKFNG91uD\o56786sgodKfE.exe
    "C:\Users\Admin\AppData\Roaming\TnKFNG91uD\o56786sgodKfE.exe"
    3⤵
    - Executes dropped EXE
    PID:1260
- - C:\Users\Admin\AppData\Roaming\iq86Tp17o5\qbsoPshE0wO.exe
    "C:\Users\Admin\AppData\Roaming\iq86Tp17o5\qbsoPshE0wO.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5648

C:\Windows\chromeupdate\chromeupdate.exe
C:\Windows\chromeupdate\chromeupdate.exe
1⤵
- Executes dropped EXE
PID:2584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~2fb13d8c.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\~2fb13d8c.dat
Size 926KB
SHA256 6606ea30c164992165c752ea25e997bf1e4191d008ff15edd4996ba523e8633e
MD5 d1cd342e68b10527fbf7455f0c285f2e
SHA1 957f21b52a740f58838cd72dd6c3e2e3a94b553b
SHA512 0cf57fdba577d1524b83ab70e7d1c706ca8d545a91bb38d6922ea53be60f1a588449247bc7bb24a162e28122647bb8b392b821f3c624f961c793fbb60e873118
SSDEEP 24576:Kr8XEmwyQcRN3mrq1KMxVbRIyvnkFwKvQgr/dmSly8wGZyczgh9Neo2wsYAHsUeF:y8UmwyQcRN3mrq1KMxVbRIyvnkFwKvQX
TLSH
T1A6156C1472A352C6E037553AD5CEBA17B1B2BC165AE0DF2B0A408FC76AD3260376B357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

YCL.exe

Path C:\Users\Admin\AppData\Local\Temp\C3vGJdJ8CEeuD4uJ\YCL.exe
Size 2.4MB
SHA256 562befc15c7530127bae89358c12bc7d902b74e747b349064c6a357cd1c49556
MD5 f1b6fe67df44f0865c707dbd39c955ce
SHA1 9b599fd3d12c55f124ff910de1b2a6f27280cea8
SHA512 5690b83914cc6d4025796bc1fe75acad257ce279b7f27ae062dfd8ae0fafdbc56f8a8bd45227ddc660395633b90006bd9c4a09f8435a625b4e7215a016f5320d
SSDEEP 49152:NxbZkNARkhxqH7VDE+46IAGHPx23n4V+bNLrwXx+sE:J2ARkhUILU34V+bNLB
TLSH
T1A3C53807D3F681D8E1FBE730CAB262735D72BC199538A65D1685CA251E30F709F29B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ee3vhvgy.yix.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ee3vhvgy.yix.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

qbsoPshE0wO.exe

Path C:\Users\Admin\AppData\Roaming\iq86Tp17o5\qbsoPshE0wO.exe
Size 874KB
SHA256 3eb383f192c4a3b30d7fbb6d34238a49c6969597bb286de790df2709f2a26343
MD5 80745874086c55c7bf00814ca112095d
SHA1 4c842796cebf6e6f30032e05377bda48ec81fe81
SHA512 9806dcbe1b7e0ec027408509d060d35450bf8c1c0c3d2896dcdd791a187336e0513b020d11d47bc5345bb92b89c55847cb6b9bdcc9f736893c18763f1e1d00c7
SSDEEP 12288:bYEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988fLn:bbJIJ4TiIaBYfTz9wC3pKqH8fLn
TLSH
T18015291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oh8TLgcTrzl6.exe

Path C:\Users\Admin\AppData\Roaming\kFhVwXt3\oh8TLgcTrzl6.exe
Size 3.0MB
SHA256 03a7ab716438198a69e19f37a5c6696775e756f35c29f8fe6b5fc1338b22d25c
MD5 5974c89992211721189da83cb2bc108e
SHA1 b0b55d2a25b39a818e567cceacbeca086d17855c
SHA512 04e5ad73b73f1a4c8b331ba355f129a830d1ddc66f40e6e80570c1bc6debab35098a631b47693695664a03cc43728e879da8a42593e94d22622dc095efbe5892
SSDEEP 49152:X4zOlcOIRYfScZl+qFFAiZb/PCYmwEgOAzZQp+QSU0HDvqrZ3g3PnPR:XL/IR0vHDkNg
TLSH
T12DE59D4AA3A900FDE027C178CE474613EB72B41553359AFB53A18D963F23BF15A3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sjmNggNMmqs.exe

Path C:\Users\Admin\AppData\Roaming\rvNkpVKKPs\sjmNggNMmqs.exe
Size 581KB
SHA256 b4990aa8dd771a09af9b559f334d680d2cfce5ba8da4e5319b36720c9159897b
MD5 38f9db3db238cc16b2ad2058d53e8500
SHA1 340a3f6f9e1be33d5072b1ca1c38bd2d48a5198d
SHA512 451abc292917ca237b6e0ee2fe54cb19d5994eb8f14acc5409ee1ac3ab036bb6d1eb4ad6826068123f0f1824f81a00f2a0ac5aa15283fba301d0500ecaf27c35
SSDEEP 12288:eB+1aSSRLhQ4xPEltMibm988p3R4j4/F7hwSSSESSNHrC8:YBSM+4xPEpb2v7N1wSSSESSNLC8
TLSH
T1E0C4BE2BE7A244FDC12B40719B97A2B1A532F8250234BA6F07D9DF322E59C740FDE654
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

N9VQkX8D6bRx.exe

Path C:\Users\Admin\AppData\Roaming\vKtfqj4\N9VQkX8D6bRx.exe
Size 16KB
SHA256 69fe2d9f48833d84fc001182e34d1e004a1019208f261c19654598dbc390bc3c
MD5 eb61c25720cef7e40116b7d7c7a565a8
SHA1 a7446cb76b8023bf7c2903427aa8fa0563990f9c
SHA512 4cb403e2dd27eab25b07ea7bd7599556e99d355e056c5b24f5140c9e2f529e58a12841b779857eeb462d8f8320e60d440779f00f8630f94d2c6c9f284a7c7a0f
SSDEEP 192:sEn3gSr0JFH8CyuMYj+THdI+J0HKVFDqBH+2sY02F0Csza:LQSrUxMYj+Tj0HcFkH+2sJO0CW
TLSH
T1E772A399B75390E9D68ED0B0D8D38FB1E571FDA20674663B2384E2391E31D878A3D117
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1052-87-0x00007FF6F6070000-0x00007FF6F607C000-memory.dmp

Download

memory/1188-69-0x00007FF63EAE0000-0x00007FF63EAEC000-memory.dmp

Download

memory/1260-314-0x00007FF77B610000-0x00007FF77B61C000-memory.dmp

Download

memory/1588-45-0x00007FF7D5BE0000-0x00007FF7D5BEC000-memory.dmp

Download

memory/2136-277-0x00007FF7E63C0000-0x00007FF7E63CC000-memory.dmp

Download

memory/2144-93-0x00007FF6F8580000-0x00007FF6F858C000-memory.dmp

Download

memory/2164-290-0x00007FF7DC450000-0x00007FF7DC45C000-memory.dmp

Download

memory/2248-335-0x000001EBEAEC0000-0x000001EBEAF72000-memory.dmp

Download

memory/2776-264-0x000001EC7F8C0000-0x000001EC7F8E2000-memory.dmp

Download

memory/2776-269-0x000001EC7FD70000-0x000001EC7FD7A000-memory.dmp

Download

memory/2776-267-0x000001EC7FC90000-0x000001EC7FCAE000-memory.dmp

Download

memory/2776-268-0x000001EC7FCB0000-0x000001EC7FD62000-memory.dmp

Download

memory/2988-249-0x00007FF75D620000-0x00007FF75D62C000-memory.dmp

Download

memory/3012-99-0x00007FF606CA0000-0x00007FF606CAC000-memory.dmp

Download

memory/3264-296-0x00007FF7EAD70000-0x00007FF7EAD7C000-memory.dmp

Download

memory/3272-284-0x00007FF749AA0000-0x00007FF749AAC000-memory.dmp

Download

memory/3416-51-0x00007FF7291A0000-0x00007FF7291AC000-memory.dmp

Download

memory/3596-63-0x00007FF650370000-0x00007FF65037C000-memory.dmp

Download

memory/3756-308-0x00007FF6224E0000-0x00007FF6224EC000-memory.dmp

Download

memory/3852-225-0x00007FF7D1BD0000-0x00007FF7D1BDC000-memory.dmp

Download

memory/4248-18-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-10-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-329-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-6-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-8-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-5-0x00000000003A0000-0x00000000003A1000-memory.dmp

Download

memory/4248-31-0x0000000010000000-0x000000001001C000-memory.dmp

Download

memory/4248-17-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-16-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-13-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-9-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-7-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-14-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4248-15-0x00000000003B0000-0x00000000003E3000-memory.dmp

Download

memory/4272-255-0x00007FF67FA70000-0x00007FF67FA7C000-memory.dmp

Download

memory/4320-237-0x00007FF782A80000-0x00007FF782A8C000-memory.dmp

Download

memory/4372-39-0x00007FF6A1AE0000-0x00007FF6A1AEC000-memory.dmp

Download

memory/4448-75-0x00007FF7B4480000-0x00007FF7B448C000-memory.dmp

Download

memory/4516-243-0x00007FF77D110000-0x00007FF77D11C000-memory.dmp

Download

memory/4700-219-0x00007FF6D12D0000-0x00007FF6D1369000-memory.dmp

Download

memory/5112-81-0x00007FF735810000-0x00007FF73581C000-memory.dmp

Download

memory/5240-0-0x00000000022F0000-0x00000000022F1000-memory.dmp

Download

memory/5240-4-0x0000000002400000-0x000000000242F000-memory.dmp

Download

memory/5240-3-0x0000000000400000-0x0000000000538000-memory.dmp

Download

memory/5240-2-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/5240-1-0x00000000004E5000-0x00000000004E6000-memory.dmp

Download

memory/5392-231-0x00007FF7D1080000-0x00007FF7D108C000-memory.dmp

Download

memory/5612-105-0x00007FF70BBC0000-0x00007FF70BBCC000-memory.dmp

Download

memory/5696-261-0x00007FF684D60000-0x00007FF684D6C000-memory.dmp

Download

memory/5944-302-0x00007FF7517D0000-0x00007FF7517DC000-memory.dmp

Download