f1acfdfd143833db10a800956c9fe6582fed936955869a297e0b9390ea8525e2

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/10/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.3MB
Sample261021-2pjk2sys7m
SHA256 f1acfdfd143833db10a800956c9fe6582fed936955869a297e0b9390ea8525e2
MD5 7abb89a98cf77c64e793b62172eb7bb6
SHA1 0908e534f5216e740601c3ec9d74b0d50a76623e
SHA512 200df5f063a9539652c592a0634a758f0191bd26358a948ba4b0d6af364cc7bdb8bf89a99dea723d3f9e89be475bf9971a709f48275ac9d1778834035726b9e6
SSDEEP 24576:NHdDWjzVccAZdLGZp7QKiqmi+G0zNqQyS3VTK6UZYnU6v7PihVGQ:bWfXAb+xJ+G0J7lm6UZBSP9Q
TLSH
T1C4261219B35786DFC35B42306965A2A1FD1E9E6071488E3AD399E0FE3EB1D3E19C06D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4400	GoogleUpdate.exe

Executes dropped EXE 4 IoCs

pid	Process
2592	GoogleUpdate.exe
4400	GoogleUpdate.exe
5124	GoogleUpdate.exe
4748	GoogleUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "\"C:\\ProgramData\\Google\\Update\\GoogleUpdate.exe\""	GoogleUpdate.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2592	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 2592	4796	file.exe	92
PID 4796 wrote to memory of 4400	4796	file.exe	93
PID 2592 wrote to memory of 5124	2592	GoogleUpdate.exe	97

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4796
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  C:\ProgramData\Google\Update\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\ProgramData\Google\Update\GoogleUpdate.exe
    "C:\ProgramData\Google\Update\GoogleUpdate.exe" -g
    3⤵
    - Executes dropped EXE
    PID:5124
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  "C:\ProgramData\Google\Update\GoogleUpdate.exe" -d "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4400

C:\ProgramData\Google\Update\GoogleUpdate.exe
"C:\ProgramData\Google\Update\GoogleUpdate.exe"
1⤵
- Executes dropped EXE
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\ProgramData\Google\Update\GoogleUpdate.exe
Size 1.3MB
SHA256 fdb5180f48dd427dffc095e69d625ffad94a5710ce6b6d629c200612c39852a5
MD5 0a153ff00902c93014c03a01e688e25e
SHA1 dfcf451069f612c375a878f689b39863efa5f290
SHA512 91528b573fdcedc31dd0087e75a5aa147d6fe5bce5eb2d5df2526f13f0da373942bdb8682606525aaaa226eae90ffd9a7ff7b4d85a0c028f48675311ea2c6ce5
SSDEEP 6144:tp7/l+NIE13zJP5L5weVMkNoLKWBxlh0x:tprl6Iu3No9/lh0x
TLSH
T1BC55B03EAB6380EEC29B8170659B66B1F839FE244050983E4354D5BC3FA7D5E5DE82C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g.pid

Path C:\ProgramData\Google\Update\g.pid
Size 8B
SHA256 335c49025805bbf44614447d2a0d042abbffa190f6890a2cff975f08aa2c59ee
MD5 f0ed0be16fa06d1fe035a77ae870eee7
SHA1 2309e2fdfcf00254792fbadea496031f5cd8d6c9
SHA512 7fb566787730575eafbc00448f6de208731e5221a1c990949a95e4d805c96d946d8f7926957b6c7a26d4a0e542cd01815a781e9ff39f30f874009136e7d09f2a
MD5 SHA1 SHA512

Submit Download

gupdater2.dll

Path C:\ProgramData\Google\Update\gupdater2.dll
Size 88KB
SHA256 313c6e59f411c2e274fa5b9cfcdcfc0cbb714f848be5d015d3258bdcf589fc3c
MD5 b38c1c5b06040733d7ac24342170c66d
SHA1 ff81d14fc42c29be25656142ad097bb3657b34f5
SHA512 a39921391ac5b5898065515a8348ea0ef0c55c13ea93c165378340ac8564b081a97b8e5a17913760bac198f7cc856a44e01daeb0de3b9f348cdd2c389a89cdb3
SSDEEP 768:Mw4DltNEZ/qN/1111111111111111111yBV87w90LUmtPQP:82S6P
TLSH
T1E8932A7BFFB3D8AEC4C6E3B4728A9EB5A0B4FC644460582D021643A477077984FAD6C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.pid

Path C:\ProgramData\Google\Update\main.pid
Size 8B
SHA256 a40dd86936680c798133e57f2f2aa43cc4e04819806e87d8410d06630a5947fd
MD5 c9ce904b1bcbd4971d46787ef8196969
SHA1 2768e4017bc27941d202da1f5f595088d21697ba
SHA512 f39f78427fb7e9d37d7d6b237d51e22ed9ece3a61f8263c048f6f547192d1d4e462bbb0179a7be9d7481acbc11d81ad17c90f5d3eb50bfe604cf6f240f4c8085
MD5 SHA1 SHA512

Submit Download

memory/2592-15-0x00007FF6B1210000-0x00007FF6B127E000-memory.dmp

Download

memory/4400-14-0x00007FF6B1210000-0x00007FF6B127E000-memory.dmp

Download

memory/4748-34-0x00007FF6B1210000-0x00007FF6B127E000-memory.dmp

Download

memory/4796-2-0x00007FF633860000-0x00007FF6339E4000-memory.dmp

Download

memory/4796-13-0x00007FF633860000-0x00007FF6339E4000-memory.dmp

Download

memory/5124-25-0x00007FF6B1210000-0x00007FF6B127E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads