Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/08/2026, 09:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe
- Size 1.4MB
- Sample260831-lrvs4azama
- SHA256 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02
- MD5 322c8cb3d9c52b2df3c5c2d2d8da82bf
- SHA1 7154079693dce7b133a6ab96792d746a74c3edd9
- SHA512 47a42b209f12ee64a2059ab2af599925a03e7eaecdfe7b0d0da7e49baaa0ce0b7f08610b614abf60c47d70cdac1203dba0b449bf677032ef1b8da724a15a1506
- SSDEEP 24576:ks8KjKjGFygcc23L1/NVOmOSGb6E3ecS4fzrjxJh9UZXlpbPvC7xtYUrEmFlo+L0:oKjKWQc2b1FVgbjrjxPe1pbPSQm1FloP
- TLSH T17C65230176E18074E4F22E30A970D6B15B7EFD746931AA0B13991E3D6F38981EA35B73
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/5172-2-0x00000000019B0000-0x00000000019C4000-memory.dmp upx behavioral2/memory/5172-3-0x00000000019B0000-0x00000000019C4000-memory.dmp upx behavioral2/memory/5172-75-0x00000000019B0000-0x00000000019C4000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_fr.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ms.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ca.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_no.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_pt-PT.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ru.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_uk.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\GoogleUpdateSetup.exe 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_es.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ml.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ro.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\GoogleUpdateBroker.exe 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_hu.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_iw.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_kn.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_sk.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_vi.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File opened for modification C:\Program Files (x86)\Google\Temp\GUT62C8.tmp 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\psmachine_64.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ko.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_pl.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdate.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\GoogleUpdateCore.exe 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_cs.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_es-419.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_nl.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_sr.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\GoogleUpdate.exe 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_am.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_et.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_it.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_mr.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_th.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ar.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_zh-TW.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\GoogleUpdateComRegisterShell64.exe 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_gu.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_sv.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_sw.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\GoogleUpdateOnDemand.exe 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_hi.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_id.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_pt-BR.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\GoogleCrashHandler64.exe 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_bn.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_en-GB.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_hr.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_lt.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_zh-CN.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ja.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\psmachine.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_da.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_en.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_fi.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_lv.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ta.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_te.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_fa.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_fil.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\psuser_64.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_bg.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_el.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_tr.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe File created C:\Program Files (x86)\Google\Temp\GUM62C7.tmp\goopdateres_ur.dll 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe"C:\Users\Admin\AppData\Local\Temp\7b3accfe6e88504075e6c1b1420f1382fe36a23ae26ed3173281293795520e02.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5172