Overview
overview
5Static
static
3EzExtractSetup.exe
windows10-2004-x64
4EzExtractSetup.exe
windows11-21h2-x64
4$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDIR/INetC.dll
windows11-21h2-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...st.exe
windows10-2004-x64
4$PLUGINSDI...st.exe
windows11-21h2-x64
4$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3GoogleUpdateSetup.exe
windows10-2004-x64
4GoogleUpdateSetup.exe
windows11-21h2-x64
4$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3EzExtractP...ll.dll
windows10-2004-x64
1EzExtractP...ll.dll
windows11-21h2-x64
1EzExtractProShell.dll
windows10-2004-x64
5EzExtractProShell.dll
windows11-21h2-x64
5EzExtractP...32.dll
windows10-2004-x64
3EzExtractP...32.dll
windows11-21h2-x64
3Analysis
-
max time kernel
95s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2024 11:59
Static task
static1
Behavioral task
behavioral1
Sample
EzExtractSetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
EzExtractSetup.exe
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NsisPlugin.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NsisPlugin.dll
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/gcinst.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/gcinst.exe
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
GoogleUpdateSetup.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
GoogleUpdateSetup.exe
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
EzExtractProCoreDll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
EzExtractProCoreDll.dll
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
EzExtractProShell.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
EzExtractProShell.dll
Resource
win11-20240802-en
Behavioral task
behavioral21
Sample
EzExtractProShell32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
EzExtractProShell32.dll
Resource
win11-20240802-en
General
-
Target
$PLUGINSDIR/gcinst.exe
-
Size
1.3MB
-
MD5
6ec7094e0756a6698b33e1420fa614d1
-
SHA1
717a3065334c0851d908d3a9c03e9fe98f577914
-
SHA256
5690d7de821e2d10210b6ae5f9a490934bc77a3005ee72c56eed00fea63bf4ce
-
SHA512
785be9a41b37265071eaf5d2fe5a9c5a7c780764eae33ede2d71099d527e1b17068951a758588a57e1b29a2a898196613c5751bc380b94fcf8cb84b8bc90f84c
-
SSDEEP
24576:kUZGvjjCcQiydy+2cB3Q3gmsSHXd34cyE7jQ9gHKM8OHdp:xUPCcQjx2cB3Q3zFjQ9aKM8cdp
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_pl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdate.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_es.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_it.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_kn.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_da.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_en.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ro.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_zh-CN.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdateSetup.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleCrashHandler.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdateOnDemand.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_en-GB.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_mr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdateBroker.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_bn.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_pt-PT.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdateCore.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_cs.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_fil.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_te.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_th.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\psuser_64.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_gu.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_is.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ja.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdate.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ar.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_el.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_es-419.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_et.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ml.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_sr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_sv.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_sw.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\psmachine_64.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_am.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_fr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_sl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_hu.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_lt.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_bg.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_id.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\GoogleUpdateSetup.exe gcinst.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdateComRegisterShell64.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_fa.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_nl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_pt-BR.dll GoogleUpdateSetup.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUTBEED.tmp GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ca.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_iw.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ms.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_fi.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_lv.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_no.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_uk.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_sk.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ta.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ur.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_zh-TW.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleCrashHandler64.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_de.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_hr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\goopdateres_ru.dll GoogleUpdateSetup.exe -
Executes dropped EXE 2 IoCs
pid Process 4356 GoogleUpdateSetup.exe 2940 GoogleUpdate.exe -
Loads dropped DLL 2 IoCs
pid Process 3064 gcinst.exe 2940 GoogleUpdate.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA GoogleUpdate.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gcinst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdateSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdate.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2940 GoogleUpdate.exe 2940 GoogleUpdate.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2940 GoogleUpdate.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3064 wrote to memory of 4356 3064 gcinst.exe 82 PID 3064 wrote to memory of 4356 3064 gcinst.exe 82 PID 3064 wrote to memory of 4356 3064 gcinst.exe 82 PID 4356 wrote to memory of 2940 4356 GoogleUpdateSetup.exe 83 PID 4356 wrote to memory of 2940 4356 GoogleUpdateSetup.exe 83 PID 4356 wrote to memory of 2940 4356 GoogleUpdateSetup.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gcinst.exe"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\gcinst.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Program Files (x86)\Google\GoogleUpdateSetup.exeGoogleUpdateSetup.exe /silent /alwayslaunchcmd /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PNABB" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22suppress_first_run_bubble%22%3Atrue%2C%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22sync_promo%22%3A%7B%22show_on_first_run_allowed%22%3Afalse%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22https%3A%2F%2Fwww.google.com%2F%22%5D%2C%22restore_on_startup_migrated%22%3Atrue%7D%7D"2⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdate.exe"C:\Program Files (x86)\Google\Temp\GUMBEEC.tmp\GoogleUpdate.exe" /silent /alwayslaunchcmd /install "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google%20Chrome&needsadmin=True&brand=PNABB" /appargs "appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22suppress_first_run_bubble%22%3Atrue%2C%22do_not_launch_chrome%22%3Atrue%2C%22make_chrome_default%22%3Atrue%7D%2C%22sync_promo%22%3A%7B%22show_on_first_run_allowed%22%3Afalse%7D%2C%22first_run_tabs%22%3A%5B%22chrome%3A%2F%2Fwelcome%22%2C%22https%3A%2F%2Fwww.google.com%22%5D%2C%22session%22%3A%7B%22restore_on_startup%22%3A4%2C%22startup_urls%22%3A%5B%22https%3A%2F%2Fwww.google.com%2F%22%5D%2C%22restore_on_startup_migrated%22%3Atrue%7D%7D"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD588a857cb7ca6702ab812666b4c88dfe9
SHA16f97409352d52db138f3637bb5d5a6478e7de4d6
SHA256027299ea8dfa96e0e59794c59abfd562e2f675e8b8b9a84028da8c58c58d243f
SHA5126f3fc98f11286823db68d45709b845f14679fad1f64cdc0f0c3ef029c486fa551e57ca22d60ad902a865fbc0b246751b4d97edeffd1ef04a0ad190e71da2b6c1
-
Filesize
158KB
MD5baf0b64af9fceab44942506f3af21c87
SHA1e78fb7c2db9c1b1f9949f4fcd4b23596c1372e05
SHA256581edeca339bb8c5ebc1d0193ad77f5cafa329c5a9adf8f5299b1afabed6623b
SHA512ee590e4d5ccdd1ab6131e19806ffd0c12731dd12cf7bfb562dd8f5896d84a88eb7901c6196c85a0b7d60aee28f8cfbba62f8438d501eabd1bb01ec0b4f8d8004
-
Filesize
1.9MB
MD59a7cd2cc8647d6052da0413a95777398
SHA13169d711b1e022af7912ca2a968be5fcaac04d23
SHA2563244dd164b91b1db785b84438d54ea69051bc9e2a21bf523bd09bbe1005c3307
SHA51264bf0ec909e33ad699c9c5d261dc739400db327b070e9faa19dfa12c637ad6d47e09126b262a04e7562c8939b6596e90b3353d27d7e1dc1eb2be5c9e6b462e6d
-
Filesize
42KB
MD548f2d63b85468b3d9f6f5c99d2e20d87
SHA17fbe2e04a723473c9ed0090afd9ea279f03226a1
SHA256713cd0392fd4a096560be8dcf5757adc6e02d919742a8ad7b4b0856e2ba53534
SHA512815d55d0f6dd514134446f442b8972531c4dba6857b979ede7d5dc537c85eb027b3ca1c7f560aef90177a98e6a19661b937f06f1f209f19e8a2676271898afe1
-
Filesize
11KB
MD5fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06