Analysis
-
max time kernel
100s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-10-2024 08:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe
Resource
win7-20241010-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe
-
Size
1.8MB
-
MD5
08d32de70897f0686481c389dda45774
-
SHA1
af902f928bd04becf7ea4e60fe7be196e7b8cdf2
-
SHA256
69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1
-
SHA512
a35d905af6fb901d39e3fcd141b6fad78806267b4103e1613c0598c81e47a3b1afd2db7a13656720e9c61e57cc0a021c9b05e13e532e232838ade1c9f3d1fcd1
-
SSDEEP
49152:kx5SUW/cxUitIGLsF0nb+tJVYleAMz77+WAAB+kn3Hnx:kvbjVkjjCAzJR+k
Score
4/10
Malware Config
Signatures
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ms.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_el.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_sv.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_tr.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUM9867.tmp\GoogleUpdateSetup.exe 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_sk.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_it.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_lt.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_nl.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_pt-BR.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ru.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ur.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\psuser.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_kn.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\GoogleUpdateSetup.exe 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_hi.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_gu.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_et.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_fr.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_hr.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_id.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_es.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_de.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_lv.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_mr.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_sw.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_cs.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_en.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_is.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_iw.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_zh-TW.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_bg.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_da.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_fi.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_zh-CN.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\GoogleCrashHandler64.exe 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\GoogleUpdateBroker.exe 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\psuser_64.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_hu.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ja.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_pt-PT.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_th.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_vi.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUT9868.tmp 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_es-419.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_no.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_en-GB.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ca.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_fil.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ml.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_sl.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\GoogleUpdateComRegisterShell64.exe 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ta.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_uk.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\GoogleUpdateOnDemand.exe 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ko.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_pl.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_te.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdate.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ar.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\goopdateres_ro.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\psmachine_64.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\GoogleCrashHandler.exe 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe File created C:\Program Files (x86)\Google\Temp\GUM9867.tmp\psmachine.dll 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe"C:\Users\Admin\AppData\Local\Temp\69919b299d23d2ac2f3eebefda974592243ea2aa4e3bab6483b479291b408da1.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1756