Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/09/2026, 19:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe
- Size 1.8MB
- Sample260923-x94phabb52
- SHA256 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04
- MD5 55c561fed56d180c13e4b5727e5857f7
- SHA1 c26a18d6c7f7fb07de3178a83bfdf1ec22c07fd1
- SHA512 4b480b9e8c7a699c8d759921b00249d2d42115c17f89f58b6b76089ab3bcd4372bb184cd4e8aa079cb17b318aac3e472690e0bd94cc24413c0b9af9a45bcc1ae
- SSDEEP 49152:GHC+rGFr8k1JdMHFnP4QfDPCImOE5dLpGtnUisb7b0X:+C6GWY/MlwQWIm/5anUP3b
- TLSH T1E585230272D084B1F5B36A3428B1E2B25E7DFD324A609B4B23C55D6E0E349D2F765B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdate.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ja.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_pt-PT.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_sr.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusUpdateSetup.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusUpdateBroker.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusUpdateComRegisterShell64.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_cs.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_sl.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_uk.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_zh-TW.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusUpdateOnDemand.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\psuser_64.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_el.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_es.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_is.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ko.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_lt.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ml.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusCrashHandler.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusUpdate.ini 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\NLog.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ca.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_mr.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_nl.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_sv.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_th.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\psmachine_64.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_bn.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_en-GB.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_it.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_lv.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_vi.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusUpdateHelper.msi 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\psuser.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_fi.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_iw.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_sw.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_tr.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusUpdate.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_hi.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ms.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ur.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_pl.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ro.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File opened for modification C:\Program Files (x86)\ASUS\Temp\GUT69BD.tmp 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_en.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\AsusCrashHandler64.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_es-419.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_et.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_no.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_hr.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ru.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_te.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\Get-AppxVersion.exe 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_am.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_bg.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_fr.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_sk.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ta.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_fil.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_hu.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_ar.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe File created C:\Program Files (x86)\ASUS\Temp\GUM69BC.tmp\asupdateres_da.dll 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe"C:\Users\Admin\AppData\Local\Temp\3d2d1887f5dda818efa61423ac9cdf9a2a511de7bfa656b6e15e7205dd079a04.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4392