fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880.exe
Size 26.0MB
Sample261102-gqmnwasz2k
SHA256 fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880
MD5 ec80c7dfe54eded39366e94232141a47
SHA1 1df0deadf2bd118776a088374112082a12ece338
SHA512 8587708a575c63ce02604c3e96818abc758eca962dbc6145811237065d0e381c4afa460c8587ba94f006a047a9dd7f00b4ae53ca9cfa3d9dfb896a9c9abc9434
SSDEEP 393216:Xp2qNiVKptgEHa74OhaZsbftfago1TM1EUyA:RIVKpSE674OsZAdaTTM1E9A
TLSH
T116579F51F70B14F6FF434C3649F9BB2F7B39D2DC89B4C55AE428242A7AA2C1B459C281
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion miner persistence

Malware Config

Signatures

Fake Chrome/Google updater delivering miners 1 IoCs

miner defense_evasion

resource	yara_rule
behavioral2/files/0x0004000000000433-9.dat	fake_chrome_update

Executes dropped EXE 17 IoCs

pid	Process
3964	ChromeMediaRunner.exe
3232	GoogleHealthService.exe
1256	GoogleChromeAgent.exe
4636	ChromeMediaRunner.exe
5936	ChromeMediaRunner.exe
5020	ChromeMediaRunner.exe
1036	ChromeMediaRunner.exe
592	ChromeMediaRunner.exe
1784	ChromeMediaRunner.exe
6004	ChromeMediaRunner.exe
4116	ChromeMediaRunner.exe
4196	ChromeMediaRunner.exe
1844	ChromeMediaRunner.exe
1484	ChromeMediaRunner.exe
3552	ChromeMediaRunner.exe
3144	ChromeMediaRunner.exe
2324	ChromeMediaRunner.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\ChromeUpdateMonitor64 = "\"C:\\Users\\Admin\\AppData\\Local\\Google\\Chrome\\dbkulu068p\\GoogleChromeAgent.exe\" /user"	fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 3964	1092	fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880.exe	90
PID 1092 wrote to memory of 3232	1092	fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880.exe	91
PID 3232 wrote to memory of 4636	3232	GoogleHealthService.exe	94
PID 3232 wrote to memory of 5936	3232	GoogleHealthService.exe	95
PID 3232 wrote to memory of 5020	3232	GoogleHealthService.exe	96
PID 3232 wrote to memory of 1036	3232	GoogleHealthService.exe	97
PID 3232 wrote to memory of 592	3232	GoogleHealthService.exe	98
PID 3232 wrote to memory of 1784	3232	GoogleHealthService.exe	99
PID 3232 wrote to memory of 6004	3232	GoogleHealthService.exe	100
PID 3232 wrote to memory of 4116	3232	GoogleHealthService.exe	101
PID 3232 wrote to memory of 4196	3232	GoogleHealthService.exe	102
PID 3232 wrote to memory of 1844	3232	GoogleHealthService.exe	103
PID 3232 wrote to memory of 1484	3232	GoogleHealthService.exe	104
PID 3232 wrote to memory of 3552	3232	GoogleHealthService.exe	105
PID 3232 wrote to memory of 3144	3232	GoogleHealthService.exe	106
PID 3232 wrote to memory of 2324	3232	GoogleHealthService.exe	107

C:\Users\Admin\AppData\Local\Temp\fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880.exe
"C:\Users\Admin\AppData\Local\Temp\fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
  2⤵
  - Executes dropped EXE
  PID:3964
- C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\GoogleHealthService.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\GoogleHealthService.exe" /watchu
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:4636
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:5936
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:5020
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:1036
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:592
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:1784
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:6004
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:4116
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:4196
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:1844
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:1484
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:3552
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:3144
- - C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
    "C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe"
    3⤵
    - Executes dropped EXE
    PID:2324

C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\GoogleChromeAgent.exe
"C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\GoogleChromeAgent.exe" /user
1⤵
- Executes dropped EXE
PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ChromeMediaRunner.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
Size 16.4MB
SHA256 263e829ada8e8f28fcf0aa5e677970aaa2adf3968a22f2fc87637b158b382c43
MD5 b256d31f9456809b46fe53acaf3d2747
SHA1 274b2a652b6c7ec4082070a1368b20097dc7fe46
SHA512 0e35d84fde2bc59426fe6c24deb0f32517f29f1a1c82c2be110d30ba190aa32d8193c214c80d346e40359fb1593631b19db53eaaf9068f23feea0a0325bed8b9
SSDEEP 196608:Xawqdrj+QH6XlrjqVKptgEP2+a7SBDC0+aA:Xp2qNiVKptgEHa74OhaA
TLSH
T114074C51B70B15F6FF435C3645F9BB2F7B39E2DC8974C51AE428242ABAA2C1F459C280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ChromeMediaRunner.exe

Path C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\ChromeMediaRunner.exe
Size 26.0MB
SHA256 fa23d6f1b559df42e247c69dd8dc3e264e720305e0411864e03eb4890713d880
MD5 ec80c7dfe54eded39366e94232141a47
SHA1 1df0deadf2bd118776a088374112082a12ece338
SHA512 8587708a575c63ce02604c3e96818abc758eca962dbc6145811237065d0e381c4afa460c8587ba94f006a047a9dd7f00b4ae53ca9cfa3d9dfb896a9c9abc9434
SSDEEP 393216:Xp2qNiVKptgEHa74OhaZsbftfago1TM1EUyA:RIVKpSE674OsZAdaTTM1E9A
TLSH
T116579F51F70B14F6FF434C3649F9BB2F7B39D2DC89B4C55AE428242A7AA2C1B459C281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_app.dll

Path C:\Users\Admin\AppData\Local\Google\Chrome\dbkulu068p\chrome_app.dll
Size 2.4MB
SHA256 f99a8760d01c8da3c8dc3723b43e221535dc6f83d5fa530e3e1cf19e5ed45dcf
MD5 f2310b0be1bd2d49d4d46b47f3c337db
SHA1 533f7d23534e00fb92ade89a351c17f592ab4219
SHA512 6c649228768bd9303ad675ec5aed3fc4e7312583e82ae0b7ad98677555968e6bdfdb3bcc503d217e2cf125ff0d797405da74c36b0c7ae7db63da7515d050f51e
SSDEEP 24576:swuVXFJG5cJNYLQvShWePD1VBuAtIiYhER+elvXMgLtKVFkI13euSyyCe60HpAQ:hUXr1sjhaAtoYCgATkmdepHpAQ
TLSH
T161C5C505F71715CFEF9541B06DBDB312EA5DCBA4A188CA779A5C827C3CB2C6E1884392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/592-30-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/1036-26-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/1092-3-0x00007FF6F8700000-0x00007FF6FA0AB000-memory.dmp

Download

memory/1092-8-0x00007FF6F8700000-0x00007FF6FA0AB000-memory.dmp

Download

memory/1092-2-0x00007FF6F8700000-0x00007FF6FA0AB000-memory.dmp

Download

memory/1092-16-0x00007FF6F8700000-0x00007FF6FA0AB000-memory.dmp

Download

memory/1256-14-0x00007FF66EA30000-0x00007FF6703DB000-memory.dmp

Download

memory/1484-48-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/1784-32-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/1844-44-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/2324-56-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/3144-54-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/3232-17-0x00007FF72B650000-0x00007FF72CFFB000-memory.dmp

Download

memory/3552-50-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/3964-12-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/4116-38-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/4196-42-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/4636-18-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/5020-24-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/5936-21-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

memory/6004-36-0x00007FF623740000-0x00007FF6250EB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads