Overview
overview
6Static
static
1Update/1.3...er.exe
windows7-x64
1Update/1.3...er.exe
windows10-2004-x64
1Update/1.3...64.exe
windows7-x64
1Update/1.3...64.exe
windows10-2004-x64
1Update/1.3...te.exe
windows7-x64
6Update/1.3...te.exe
windows10-2004-x64
6Update/1.3...er.exe
windows7-x64
1Update/1.3...er.exe
windows10-2004-x64
1Update/1.3...64.exe
windows7-x64
4Update/1.3...64.exe
windows10-2004-x64
4Update/1.3...re.exe
windows7-x64
1Update/1.3...re.exe
windows10-2004-x64
1Update/1.3...nd.exe
windows7-x64
1Update/1.3...nd.exe
windows10-2004-x64
1Update/1.3...up.exe
windows7-x64
4Update/1.3...up.exe
windows10-2004-x64
4Update/1.3...te.dll
windows7-x64
6Update/1.3...te.dll
windows10-2004-x64
6Update/1.3...am.dll
windows7-x64
1Update/1.3...am.dll
windows10-2004-x64
1Update/1.3...ar.dll
windows7-x64
1Update/1.3...ar.dll
windows10-2004-x64
1Update/1.3...bg.dll
windows7-x64
1Update/1.3...bg.dll
windows10-2004-x64
1Update/1.3...bn.dll
windows7-x64
1Update/1.3...bn.dll
windows10-2004-x64
1Update/1.3...ca.dll
windows7-x64
1Update/1.3...ca.dll
windows10-2004-x64
1Update/1.3...cs.dll
windows7-x64
1Update/1.3...cs.dll
windows10-2004-x64
1Update/1.3...da.dll
windows7-x64
1Update/1.3...da.dll
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
08-12-2023 17:51
Static task
static1
Behavioral task
behavioral1
Sample
Update/1.3.36.152/GoogleCrashHandler.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Update/1.3.36.152/GoogleCrashHandler.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral3
Sample
Update/1.3.36.152/GoogleCrashHandler64.exe
Resource
win7-20231201-en
Behavioral task
behavioral4
Sample
Update/1.3.36.152/GoogleCrashHandler64.exe
Resource
win10v2004-20231201-en
Behavioral task
behavioral5
Sample
Update/1.3.36.152/GoogleUpdate.exe
Resource
win7-20231130-en
Behavioral task
behavioral6
Sample
Update/1.3.36.152/GoogleUpdate.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
Update/1.3.36.152/GoogleUpdateBroker.exe
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
Update/1.3.36.152/GoogleUpdateBroker.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
Update/1.3.36.152/GoogleUpdateComRegisterShell64.exe
Resource
win7-20231020-en
Behavioral task
behavioral10
Sample
Update/1.3.36.152/GoogleUpdateComRegisterShell64.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral11
Sample
Update/1.3.36.152/GoogleUpdateCore.exe
Resource
win7-20231023-en
Behavioral task
behavioral12
Sample
Update/1.3.36.152/GoogleUpdateCore.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral13
Sample
Update/1.3.36.152/GoogleUpdateOnDemand.exe
Resource
win7-20231020-en
Behavioral task
behavioral14
Sample
Update/1.3.36.152/GoogleUpdateOnDemand.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral15
Sample
Update/1.3.36.152/GoogleUpdateSetup.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
Update/1.3.36.152/GoogleUpdateSetup.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral17
Sample
Update/1.3.36.152/goopdate.dll
Resource
win7-20231201-en
Behavioral task
behavioral18
Sample
Update/1.3.36.152/goopdate.dll
Resource
win10v2004-20231130-en
Behavioral task
behavioral19
Sample
Update/1.3.36.152/goopdateres_am.dll
Resource
win7-20231201-en
Behavioral task
behavioral20
Sample
Update/1.3.36.152/goopdateres_am.dll
Resource
win10v2004-20231130-en
Behavioral task
behavioral21
Sample
Update/1.3.36.152/goopdateres_ar.dll
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
Update/1.3.36.152/goopdateres_ar.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral23
Sample
Update/1.3.36.152/goopdateres_bg.dll
Resource
win7-20231130-en
Behavioral task
behavioral24
Sample
Update/1.3.36.152/goopdateres_bg.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral25
Sample
Update/1.3.36.152/goopdateres_bn.dll
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
Update/1.3.36.152/goopdateres_bn.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral27
Sample
Update/1.3.36.152/goopdateres_ca.dll
Resource
win7-20231020-en
Behavioral task
behavioral28
Sample
Update/1.3.36.152/goopdateres_ca.dll
Resource
win10v2004-20231130-en
Behavioral task
behavioral29
Sample
Update/1.3.36.152/goopdateres_cs.dll
Resource
win7-20231025-en
Behavioral task
behavioral30
Sample
Update/1.3.36.152/goopdateres_cs.dll
Resource
win10v2004-20231127-en
Behavioral task
behavioral31
Sample
Update/1.3.36.152/goopdateres_da.dll
Resource
win7-20231130-en
Behavioral task
behavioral32
Sample
Update/1.3.36.152/goopdateres_da.dll
Resource
win10v2004-20231201-en
General
-
Target
Update/1.3.36.152/GoogleUpdateBroker.exe
-
Size
114KB
-
MD5
9482267d8e065d5c3cfe30c69b41b30c
-
SHA1
b0d7b3b52fc3faac508a01a61ff9e9e7ed8a16fd
-
SHA256
23085b1bbb7d7b175ee9c4fc9db4e7dd8981a3f5246cd864ab178c53c0612758
-
SHA512
33c19803c00834755d2a6e75481b0bc0d50dfaeb4cf95d34bc4bd22b82cb58ab72f7e7af9d1e56c19e68374365d4fd095b8a4121c0c0099254a0bdba2dd86c63
-
SSDEEP
3072:uMxJ7Rfp8K172YPrN4vzT+PgZpsB+I3+EO5C0enIb:uMH7cCxPapsB+w9woq
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
GoogleUpdateBroker.exedescription pid process target process PID 2220 wrote to memory of 2068 2220 GoogleUpdateBroker.exe GoogleUpdate.exe PID 2220 wrote to memory of 2068 2220 GoogleUpdateBroker.exe GoogleUpdate.exe PID 2220 wrote to memory of 2068 2220 GoogleUpdateBroker.exe GoogleUpdate.exe PID 2220 wrote to memory of 2068 2220 GoogleUpdateBroker.exe GoogleUpdate.exe PID 2220 wrote to memory of 2068 2220 GoogleUpdateBroker.exe GoogleUpdate.exe PID 2220 wrote to memory of 2068 2220 GoogleUpdateBroker.exe GoogleUpdate.exe PID 2220 wrote to memory of 2068 2220 GoogleUpdateBroker.exe GoogleUpdate.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\GoogleUpdateBroker.exe"C:\Users\Admin\AppData\Local\Temp\Update\1.3.36.152\GoogleUpdateBroker.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\Update\GoogleUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Update\GoogleUpdate.exe" /broker2⤵PID:2068
-