f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8.exe
Size 5.1MB
Sample260930-gqlftayvhw
SHA256 f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8
MD5 e13f48ccd271b30795fa1147ff14b6f5
SHA1 8a8fb4d434ce7f20f9b33d3b256ef3a197844821
SHA512 8851018e74fb59e24222026dc5beb01ace090196d6a536d4505f680caae549be48d1d26928095ded078493d2adbb131fe8b48da02a92dc82c6dee884c19bb7fe
SSDEEP 49152:W8jqWqH3ELVHbzbmGzlHMYKoAyKuoVU5e+eyksv9D:WzWqHEVHPKGTKo1sXsVD
TLSH
T19346231AB38B41DFD386C23011256752FE2EEE2475849D3A979AE1BD3CB2C3E19C16D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3528	GoogleUpdate.exe

Executes dropped EXE 2 IoCs

pid	Process
3224	GoogleUpdate.exe
3528	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3224	3448	f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8.exe	88
PID 3448 wrote to memory of 3528	3448	f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8.exe	89

C:\Users\Admin\AppData\Local\Temp\f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8.exe
"C:\Users\Admin\AppData\Local\Temp\f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3448
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  C:\ProgramData\Google\Update\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  PID:3224
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  "C:\ProgramData\Google\Update\GoogleUpdate.exe" -d "C:\Users\Admin\AppData\Local\Temp\f09bdec87820a4d465165eabb6e33914d588a6c6f12ee01acfe917ae3f25e2e8.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\ProgramData\Google\Update\GoogleUpdate.exe
Size 1.9MB
SHA256 b4e481eaa3548c484fbc77d585aad4ef8c2fbf166adafd74553ed9f1238ac4e8
MD5 a67485eb8fc922f2cf53d1b73cb98d87
SHA1 6fb30a3751d35380411be5cee1c0040cb9002cc4
SHA512 20038f62b794f5d9801a526b25bf189c2945445e33beb517b1f2c6c391d4169708b293423e7ba7a5c30f32fa0d2ba6076e6c24e9b971e234222e86d820ae53bd
SSDEEP 3072:Rb7Vm4p2Sh3bDSiEpdskceD2n5/Ad3ELYuIy9HJP5L5id2tsDOkg5x6xPbQeQRKI:RVmf8bDsmJiEMKlJP5L5oDrgSxDQf6E
TLSH
T18295C039E76380DEC6A7927064996BA1F835FE241060983E4389D2BD3FB7C6D1DD92C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3224-12-0x00007FF7931C0000-0x00007FF793277000-memory.dmp

Download

memory/3448-2-0x00007FF6D8170000-0x00007FF6D82B3000-memory.dmp

Download

memory/3448-7-0x00007FF6D8170000-0x00007FF6D82B3000-memory.dmp

Download

memory/3528-13-0x00007FF7931C0000-0x00007FF793277000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads