Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'ChromeUpdater' = '%LOCALAPPDATA%\Google\Chrome\User Data\chrome_updater.exe'
Malicious functions
Executes the following
- '<SYSTEM32>\taskkill.exe' /f /im chrome_updater.exe
Modifies file system
Creates the following files
- %TEMP%\onefile_3736_134182016888094764\client.dll
- %TEMP%\onefile_3736_134182016888094764\81d243bd2c585b0f4821__mypyc.pyd
- %TEMP%\onefile_3736_134182016888094764\_bz2.pyd
- %TEMP%\onefile_3736_134182016888094764\_ctypes.pyd
- %TEMP%\onefile_3736_134182016888094764\_decimal.pyd
- %TEMP%\onefile_3736_134182016888094764\_elementtree.pyd
- %TEMP%\onefile_3736_134182016888094764\_hashlib.pyd
- %TEMP%\onefile_3736_134182016888094764\_lzma.pyd
- %TEMP%\onefile_3736_134182016888094764\_multiprocessing.pyd
- %TEMP%\onefile_3736_134182016888094764\_queue.pyd
- %TEMP%\onefile_3736_134182016888094764\_socket.pyd
- %TEMP%\onefile_3736_134182016888094764\_ssl.pyd
- %TEMP%\onefile_3736_134182016888094764\_wmi.pyd
- %TEMP%\onefile_3736_134182016888094764\libcrypto-3.dll
- %TEMP%\onefile_3736_134182016888094764\libffi-8.dll
- %TEMP%\onefile_3736_134182016888094764\libssl-3.dll
- %TEMP%\onefile_3736_134182016888094764\message.exe
- %TEMP%\onefile_3736_134182016888094764\pyexpat.pyd
- %TEMP%\onefile_3736_134182016888094764\python3.dll
- %TEMP%\onefile_3736_134182016888094764\python312.dll
- %TEMP%\onefile_3736_134182016888094764\select.pyd
- %TEMP%\onefile_3736_134182016888094764\unicodedata.pyd
- %TEMP%\onefile_3736_134182016888094764\vcruntime140.dll
- %TEMP%\onefile_3736_134182016888094764\vcruntime140_1.dll
- %TEMP%\onefile_3736_134182016888094764\certifi\cacert.pem
- %TEMP%\onefile_3736_134182016888094764\charset_normalizer\cd.pyd
- %TEMP%\onefile_3736_134182016888094764\charset_normalizer\md.pyd
- %TEMP%\onefile_3736_134182016888094764\psutil\_psutil_windows.pyd
- %LOCALAPPDATA%\google\chrome\user data\chrome_updater.exe
- %TEMP%\onefile_2236_134182017025670084\client.dll
- %TEMP%\onefile_2236_134182017025670084\81d243bd2c585b0f4821__mypyc.pyd
- %TEMP%\onefile_2236_134182017025670084\_bz2.pyd
- %TEMP%\onefile_2236_134182017025670084\_ctypes.pyd
- %TEMP%\onefile_2236_134182017025670084\_decimal.pyd
- %TEMP%\onefile_2236_134182017025670084\_elementtree.pyd
- %TEMP%\onefile_2236_134182017025670084\_hashlib.pyd
- %TEMP%\onefile_2236_134182017025670084\_lzma.pyd
- %TEMP%\onefile_2236_134182017025670084\_multiprocessing.pyd
- %TEMP%\onefile_2236_134182017025670084\_queue.pyd
- %TEMP%\onefile_2236_134182017025670084\_socket.pyd
- %TEMP%\onefile_2236_134182017025670084\_ssl.pyd
- %TEMP%\onefile_2236_134182017025670084\_wmi.pyd
- %TEMP%\onefile_2236_134182017025670084\libcrypto-3.dll
- %TEMP%\onefile_2236_134182017025670084\libffi-8.dll
- %TEMP%\onefile_2236_134182017025670084\libssl-3.dll
- %TEMP%\onefile_2236_134182017025670084\message.exe
- %TEMP%\onefile_2236_134182017025670084\pyexpat.pyd
- %TEMP%\onefile_2236_134182017025670084\python3.dll
- %TEMP%\onefile_2236_134182017025670084\python312.dll
- %TEMP%\onefile_2236_134182017025670084\select.pyd
- %TEMP%\onefile_2236_134182017025670084\unicodedata.pyd
- %TEMP%\onefile_2236_134182017025670084\vcruntime140.dll
- %TEMP%\onefile_2236_134182017025670084\vcruntime140_1.dll
- %TEMP%\onefile_2236_134182017025670084\certifi\cacert.pem
- %TEMP%\onefile_2236_134182017025670084\charset_normalizer\cd.pyd
- %TEMP%\onefile_2236_134182017025670084\charset_normalizer\md.pyd
- %TEMP%\onefile_2236_134182017025670084\psutil\_psutil_windows.pyd
- %LOCALAPPDATA%\google\chrome\user data\updater_config.txt
Sets the 'hidden' attribute to the following files
- %LOCALAPPDATA%\google\chrome\user data\updater_config.txt
Network activity
Connects to
- '21#.#32.120.102':12848
- '<DNS_SERVER>':53
Miscellaneous
Searches for the following windows
- ClassName: '' WindowName: ''
Creates and executes the following
- '%LOCALAPPDATA%\google\chrome\user data\chrome_updater.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im chrome_updater.exe"
- '<SYSTEM32>\cmd.exe' /c "del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ChromeUpdater.lnk" /f /s /q"
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\Google\Chrome\User Data\chrome_updater.exe""
- '<SYSTEM32>\cmd.exe' /c "taskkill /f /im chrome_updater.exe"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "del "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ChromeUpdater.lnk" /f /s /q"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%LOCALAPPDATA%\Google\Chrome\User Data\chrome_updater.exe""' (with hidden window)
