Overview
overview
8Static
static
3EzExtractSetup.exe
windows10-2004-x64
4EzExtractSetup.exe
windows11-ltsc_2024-x64
5$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDIR/INetC.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDI...in.dll
windows11-ltsc_2024-x64
6$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...on.ico
windows10-2004-x64
3$PLUGINSDI...on.ico
windows11-ltsc_2024-x64
8$PLUGINSDI...ge.ico
windows10-2004-x64
3$PLUGINSDI...ge.ico
windows11-ltsc_2024-x64
3$PLUGINSDI...st.exe
windows10-2004-x64
4$PLUGINSDI...st.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
8GoogleUpdateSetup.exe
windows10-2004-x64
4GoogleUpdateSetup.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows11-ltsc_2024-x64
3EzExtractP...ll.dll
windows10-2004-x64
1EzExtractP...ll.dll
windows11-ltsc_2024-x64
6EzExtractProShell.dll
windows10-2004-x64
5EzExtractProShell.dll
windows11-ltsc_2024-x64
5EzExtractP...32.dll
windows10-2004-x64
3EzExtractP...32.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
106s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/07/2026, 22:09
Behavioral task
behavioral1
Sample
EzExtractSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
EzExtractSetup.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/INetC.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NsisPlugin.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NsisPlugin.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/chrome_icon.ico
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/chrome_icon.ico
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/chrome_image.ico
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/chrome_image.ico
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/gcinst.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/gcinst.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
GoogleUpdateSetup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
GoogleUpdateSetup.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
EzExtractProCoreDll.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
EzExtractProCoreDll.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
EzExtractProShell.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
EzExtractProShell.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
EzExtractProShell32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
EzExtractProShell32.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
General
- Target GoogleUpdateSetup.exe
- Size 1.3MB
- Sample260705-121vesf12v
- SHA256 027299ea8dfa96e0e59794c59abfd562e2f675e8b8b9a84028da8c58c58d243f
- MD5 88a857cb7ca6702ab812666b4c88dfe9
- SHA1 6f97409352d52db138f3637bb5d5a6478e7de4d6
- SHA512 6f3fc98f11286823db68d45709b845f14679fad1f64cdc0f0c3ef029c486fa551e57ca22d60ad902a865fbc0b246751b4d97edeffd1ef04a0ad190e71da2b6c1
- SSDEEP 24576:+xCKHNv19YcQuyfycSQhTQ3WIssBXd3YcmELjQDgHKoaOHdh2Y:vKH1zYcQXPSQhTQ3NRjQDaKoacdh1
- TLSH T1E855231476E18471F1F30E355870E6B14BBEFD349910999FA3889E390E70A41EA36B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_et.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_fa.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_no.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_zh-TW.dll GoogleUpdateSetup.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleUpdateSetup.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdate.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleUpdateOnDemand.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_de.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_es.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_es-419.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_nl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_pt-BR.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_is.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_it.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_uk.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_vi.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_fi.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_fr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleUpdate.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_id.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_pl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\psuser.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleCrashHandler64.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_sv.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\psmachine_64.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_bn.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_cs.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_gu.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_iw.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ja.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_mr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_sr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleUpdateCore.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_bg.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_sw.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_tr.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ur.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_sk.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\psmachine.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_fil.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ml.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_zh-CN.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_da.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_el.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ms.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_te.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_th.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ar.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\psuser_64.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ca.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_sl.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ta.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleUpdateSetup.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleUpdateBroker.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_hu.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_ko.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_pt-PT.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\GoogleCrashHandler.exe GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_am.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_en.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_en-GB.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_hi.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_kn.dll GoogleUpdateSetup.exe File created C:\Program Files (x86)\Google\Temp\GUM7AD9.tmp\goopdateres_lt.dll GoogleUpdateSetup.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GoogleUpdateSetup.exe