Analysis
- user interaction
yes - max time kernel
14s - max time network
245s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/09/2026, 23:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10v2004-20260911-en
2 signatures
300 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win11ltsc2024-20260911-en
3 signatures
300 seconds
General
- Target Setup.exe
- Size 28.2MB
- Sample260916-3n2wnsfe73
- SHA256 5842b78cb1682ea77218b61aad1d05bf62b2b3a77c354edcfa769aee02af043a
- MD5 6667e8dd159777a719bc38dc69a74fc4
- SHA1 a191a79fd011fe2fc853242e012e9a8b6b5c0fb7
- SHA512 742dff87433141853bfd535dc81069192517fbc738773e781bf2f4988804dd44018c254984182bd37a4ca26a36861a8a7bde696e090b57ddcee74c4dea9d1c09
- SSDEEP 786432:AwFTHrUy929C2KBL8Y0YZXFHCYtAdeYpei3CoMy:AKTHrUy9A0BLtJZX/OdeeeklMy
- TLSH T15C5733B4EC47FA96E6A661BCF317B32D8D369E3549581629CBBDC8F8B4880705DD08D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 3012 gupdater.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 740 wrote to memory of 3012 740 Setup.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\ProgramData\Google\Update\lp9xvoxz\gupdater.exe"C:\ProgramData\Google\Update\lp9xvoxz\gupdater.exe" /install22⤵
- Executes dropped EXE
PID:3012
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Google\Update\lp9xvoxz\gupdater.exe
- Size 28.2MB
- SHA256 5842b78cb1682ea77218b61aad1d05bf62b2b3a77c354edcfa769aee02af043a
- MD5 6667e8dd159777a719bc38dc69a74fc4
- SHA1 a191a79fd011fe2fc853242e012e9a8b6b5c0fb7
- SHA512 742dff87433141853bfd535dc81069192517fbc738773e781bf2f4988804dd44018c254984182bd37a4ca26a36861a8a7bde696e090b57ddcee74c4dea9d1c09
- SSDEEP 786432:AwFTHrUy929C2KBL8Y0YZXFHCYtAdeYpei3CoMy:AKTHrUy9A0BLtJZX/OdeeeklMy
- TLSH T15C5733B4EC47FA96E6A661BCF317B32D8D369E3549581629CBBDC8F8B4880705DD08D0
- MD5 SHA1 SHA512 SSDEEP TLSH