Analysis
-
max time kernel
44s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-01-2025 21:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
GoogleUpdatesw.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
300 seconds
General
-
Target
GoogleUpdatesw.exe
-
Size
193KB
-
MD5
eceafd1f4ea2330cace3e01abadb5708
-
SHA1
812026d0f7f651d9dad1663e3c4c30a36d48a9bb
-
SHA256
b116fb54a2c9348c77db4cb1007703d7c442064e576736145ee1888b54fe560b
-
SHA512
ddad572f43452627b65156a2ea3f552cfa3f321663ab392b1ad6b9d746b5a2c81748b54009fbd00baeaadd5b6b551ba7ec2229c66e574f9e075f74fef7970ab6
-
SSDEEP
3072:9KXYRI3KBms7dwpXOAoRLPr8XUk5Ysr5L0kN8zJ2AfVVBbOm2btPc:PcEPWOAoRLPkUctgh2UHi6
Score
10/10
Malware Config
Extracted
Family
asyncrat
Version
1.0.7
Botnet
GDFjbxc9as
Mutex
Gx0edRwRzsDs0gzwQ
Attributes
-
delay
1
-
install
true
-
install_file
GoogleUpdates.exe
-
install_folder
%AppData%
-
pastebin_config
https://pastebin.com/raw/QLnQD5yh
aes.plain
Signatures
-
Asyncrat family
-
Async RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0007000000023c9c-29.dat family_asyncrat -
Executes dropped EXE 3 IoCs
pid Process 3092 GoogleUpdatesw.exe 4356 GoogleUpdatesw.exe 3628 GoogleUpdatesw.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdatesw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdatesw.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdatesw.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 828 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 828 taskmgr.exe Token: SeSystemProfilePrivilege 828 taskmgr.exe Token: SeCreateGlobalPrivilege 828 taskmgr.exe Token: 33 828 taskmgr.exe Token: SeIncBasePriorityPrivilege 828 taskmgr.exe -
Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe -
Suspicious use of SendNotifyMessage 57 IoCs
pid Process 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe 828 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3624 wrote to memory of 3092 3624 GoogleUpdatesw.exe 84 PID 3624 wrote to memory of 3092 3624 GoogleUpdatesw.exe 84 PID 1996 wrote to memory of 4356 1996 GoogleUpdatesw.exe 109 PID 1996 wrote to memory of 4356 1996 GoogleUpdatesw.exe 109 PID 4044 wrote to memory of 3628 4044 GoogleUpdatesw.exe 114 PID 4044 wrote to memory of 3628 4044 GoogleUpdatesw.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\GoogleUpdatesw.exe"C:\Users\Admin\AppData\Local\Temp\GoogleUpdatesw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEFl0DED-35SE-4e06-938l-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEFl0DED-35SE-4e06-938l-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exe2⤵
- Executes dropped EXE
PID:3092
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:828
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\GoogleUpdatesw.exe"C:\Users\Admin\AppData\Local\Temp\GoogleUpdatesw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEFl0DED-355E-4e06-93Bl-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEFl0DED-355E-4e06-93Bl-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exe2⤵
- Executes dropped EXE
PID:4356
-
-
C:\Users\Admin\AppData\Local\Temp\GoogleUpdatesw.exe"C:\Users\Admin\AppData\Local\Temp\GoogleUpdatesw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEF10DED-355E-4e06-938l-9B2407F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEF10DED-355E-4e06-938l-9B2407F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exe2⤵
- Executes dropped EXE
PID:3628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEFl0DED-355E-4e06-93Bl-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exe
Filesize101KB
MD5d7fe63ee6cc77ca031e9e70b24577497
SHA1940b1cb7b634620f7af2920ab589b818f49ab705
SHA2561815cc4a209b11255c2d1491cc166ed6fe1241ad76b8962b95609ee260977ba3
SHA51286eaf68feb4c3b6637cd09133bfe51f386bc03e3ce05dcfe5da0b1b22f74da12d06873ad7a80ed98a27ad1160f5312f7d2bf92325ecee43f554461aebdccdd81
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Security\{FEFl0DED-35SE-4e06-938l-9B24D7F7CC88}.{2559a1f2-21d7-11d4-bdaf-00c04f60b9f0}\GoogleUpdatesw.exe
Filesize101KB
MD5b84d269dfe8d0d34a56ddd58101f8356
SHA14db8bbcaf8710c8d8f2765b25e9ee8defea8df36
SHA256a4f14efa09ffd1089aff6686c43af8d7d47c4c52408f27d18771562f3e59002c
SHA5128b63bf18da4ddcb8adaaf13425c9d051786dccf313b0c0f37dbf75ebf5da738dcb45abff71e98da441d0491d5f744ce7320ce612afa0303c0613b790d317ec52