67bc906f53178ef648583252c0059b91c1c23bedbb245edd3fe93ea12105b94c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 10:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.7MB
Sample261022-myldnset2n
SHA256 67bc906f53178ef648583252c0059b91c1c23bedbb245edd3fe93ea12105b94c
MD5 63d6ede8d285ca4ee2d5983cba3c2275
SHA1 34dd1a13203075c3ff729c44f6880641ce4c96b8
SHA512 75eb7b381f0c8044c09a3a1660a7262a4d2eac6ee3e876c67f65583294025d497764832edfb8e1581ef45a75a66427d5ef917c5e6d79d9c1689ff49a85d310af
SSDEEP 49152:6UEXeQerJJaOIOaLsURbqyoVi27biYQug1IjhJ+6mglbevW7pgqD:6Pb+2OIOOJB272lVujOvAtD
TLSH
T1FE36232EB72761DEC797533090A963B2FD1D5F2071449D3A8240E1BE3EB2C6E65E12E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion persistence

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4436	GoogleUpdate.exe

Executes dropped EXE 4 IoCs

pid	Process
4976	GoogleUpdate.exe
4436	GoogleUpdate.exe
4680	GoogleUpdate.exe
912	GoogleUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "\"C:\\ProgramData\\Google\\Update\\GoogleUpdate.exe\""	GoogleUpdate.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4976	GoogleUpdate.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4976	2244	file.exe	94
PID 2244 wrote to memory of 4436	2244	file.exe	95
PID 4976 wrote to memory of 4680	4976	GoogleUpdate.exe	98

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  C:\ProgramData\Google\Update\GoogleUpdate.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\ProgramData\Google\Update\GoogleUpdate.exe
    "C:\ProgramData\Google\Update\GoogleUpdate.exe" -g
    3⤵
    - Executes dropped EXE
    PID:4680
- C:\ProgramData\Google\Update\GoogleUpdate.exe
  "C:\ProgramData\Google\Update\GoogleUpdate.exe" -d "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4436

C:\ProgramData\Google\Update\GoogleUpdate.exe
"C:\ProgramData\Google\Update\GoogleUpdate.exe"
1⤵
- Executes dropped EXE
PID:912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GoogleUpdate.exe

Path C:\ProgramData\Google\Update\GoogleUpdate.exe
Size 2.3MB
SHA256 10ea14091f6ac287062e8634533fc1912fa7c9d5bb5347f049356f729d1d3914
MD5 24bffa2824284bec13ab5d48ed3fb1fa
SHA1 f89a29f7574e26e4ddf163f85ace5b5d1fabfd92
SHA512 f680c98bb02e14b541ba96d459819f4c97793033be45000c2a2a354a086a12b671a10ae90de34d47d6bc4ff9715cb18a0cfba6202663c8dec485f67034f77642
SSDEEP 3072:VF4zFfpre6qA0hR37geD2n5/ApKfDfzakJP5L5Pxkd2Du5HlM7oOMQMc:VqFhezhRUoMDOkJP5L5Pxe5HlkoqMc
TLSH
T10DB5D03BF76380EAC68792B0E59E6AE1F829BD6410608C3D435481BC3F7BD691DD5AC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

g.pid

Path C:\ProgramData\Google\Update\g.pid
Size 8B
SHA256 0426cf9610eac29ad60b0d374d18f4f5891664befcb5ea7e3f09b0f6dc377f34
MD5 62163493f329f592878244f5a3ecb0dd
SHA1 6eba261cbc13813e71664f57859f2672788281ca
SHA512 41b50eaa6266f7a3934320b845227e7c39a0ba16b653397dda2c82a934a69eeb89f88bad2a8cae7860c0697c96ca1c2c258e6dd765a5897ce081c11d5a0e859e
MD5 SHA1 SHA512

Submit Download

gupdater2.dll

Path C:\ProgramData\Google\Update\gupdater2.dll
Size 209KB
SHA256 743291d28518b2c8bd4c43022814a0230311734f34aa882150c73ce69b8e128e
MD5 50b69928546c6786e9b60767df97cc3a
SHA1 3a7cb649646be247f49d47626f26eee16cb58d3a
SHA512 14377f9ccd40ba714f4545324f563e09dfaeec9fddfe760b3a86498b9897644bee06313721142547234fda13354123a401d058a1a6893fdf0e2c3710d42ac430
SSDEEP 768:Aw4DltNEZ/qN/1111111111111111111yCVftwXAi0ilGgSlQxIvfsBtromI:Q2SJ
TLSH
T15A247D6BFF53D8ADC5CAA3B4718E9EB9A0F9FD260460091C5362036477077988F6DAC1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.pid

Path C:\ProgramData\Google\Update\main.pid
Size 8B
SHA256 fbddbb028b6e963db62f64bed40020788a61353c9592e9b7331572ff74750448
MD5 7ff6d2e655590eb8b1a58dc381e3a45a
SHA1 890ef38da9cbd9ec47b96a1748baf907c046e924
SHA512 b84c97866419c2ed9eaa46ce2bf723bb259efe08327e54b5eb529c7948a38593fce6f33a58f489d089702d37dbd54b523b6974a8c34bfe75c51adf90b511de47
MD5 SHA1 SHA512

Submit Download

memory/912-33-0x00007FF629D30000-0x00007FF629E31000-memory.dmp

Download

memory/2244-2-0x00007FF6B0E70000-0x00007FF6B0FBE000-memory.dmp

Download

memory/2244-8-0x00007FF6B0E70000-0x00007FF6B0FBE000-memory.dmp

Download

memory/4436-13-0x00007FF629D30000-0x00007FF629E31000-memory.dmp

Download

memory/4680-24-0x00007FF629D30000-0x00007FF629E31000-memory.dmp

Download

memory/4976-14-0x00007FF629D30000-0x00007FF629E31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads