Overview
overview
6Static
static
3Geometry D...11.zip
windows10-2004-x64
1Geometry D...sc.xml
windows10-2004-x64
1Geometry D...MD.xml
windows10-2004-x64
1Geometry D...sc.xml
windows10-2004-x64
1Geometry D...ts.mp3
windows10-2004-x64
6Geometry D...ck.mp3
windows10-2004-x64
6Geometry D...se.mp3
windows10-2004-x64
6Geometry D...de.mp3
windows10-2004-x64
6Geometry D....plist
windows10-2004-x64
3Geometry D...ng.mp3
windows10-2004-x64
6Geometry D...hd.xml
windows10-2004-x64
1Geometry D...hd.png
windows10-2004-x64
3Geometry D...hd.xml
windows10-2004-x64
1Geometry D...hd.png
windows10-2004-x64
3Geometry D...et.xml
windows10-2004-x64
1Geometry D...et.png
windows10-2004-x64
3Geometry D...ls.dat
windows10-2004-x64
3Geometry D...Go.mp3
windows10-2004-x64
6Geometry D...ep.mp3
windows10-2004-x64
6Geometry D...nk.mp3
windows10-2004-x64
6Geometry D...es.mp3
windows10-2004-x64
6Geometry D...ub.mp3
windows10-2004-x64
6Geometry D...ed.mp3
windows10-2004-x64
6Geometry D...ut.mp3
windows10-2004-x64
6Geometry D...hd.xml
windows10-2004-x64
1Geometry D...hd.png
windows10-2004-x64
3Geometry D...hd.xml
windows10-2004-x64
1Geometry D...hd.png
windows10-2004-x64
3Geometry D...et.xml
windows10-2004-x64
1Geometry D...et.png
windows10-2004-x64
3Geometry D...es.mp3
windows10-2004-x64
6Geometry D...ix.mp3
windows10-2004-x64
6Analysis
-
max time kernel
1328s -
max time network
1170s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-es -
resource tags
arch:x64arch:x86image:win10v2004-20231023-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
24-10-2023 02:54
Static task
static1
Behavioral task
behavioral1
Sample
Geometry Dash v2.11.zip
Resource
win10v2004-20231023-es
Behavioral task
behavioral2
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/AchievementsDesc.xml
Resource
win10v2004-20231020-es
Behavioral task
behavioral3
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/AchievementsDescMD.xml
Resource
win10v2004-20231023-es
Behavioral task
behavioral4
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/AchievementsLiteDesc.xml
Resource
win10v2004-20231020-es
Behavioral task
behavioral5
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/AirborneRobots.mp3
Resource
win10v2004-20231023-es
Behavioral task
behavioral6
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/BackOnTrack.mp3
Resource
win10v2004-20231020-es
Behavioral task
behavioral7
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/BaseAfterBase.mp3
Resource
win10v2004-20231020-es
Behavioral task
behavioral8
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/BeastMode.mp3
Resource
win10v2004-20231023-es
Behavioral task
behavioral9
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/BlackSludge_AnimDesc.plist
Resource
win10v2004-20231023-es
Behavioral task
behavioral10
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/BlastProcessing.mp3
Resource
win10v2004-20231020-es
Behavioral task
behavioral11
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CCControlColourPickerSpriteSheet-hd.xml
Resource
win10v2004-20231023-es
Behavioral task
behavioral12
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CCControlColourPickerSpriteSheet-hd.png
Resource
win10v2004-20231023-es
Behavioral task
behavioral13
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CCControlColourPickerSpriteSheet-uhd.xml
Resource
win10v2004-20231020-es
Behavioral task
behavioral14
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CCControlColourPickerSpriteSheet-uhd.png
Resource
win10v2004-20231020-es
Behavioral task
behavioral15
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CCControlColourPickerSpriteSheet.xml
Resource
win10v2004-20231023-es
Behavioral task
behavioral16
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CCControlColourPickerSpriteSheet.png
Resource
win10v2004-20231020-es
Behavioral task
behavioral17
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CCLocalLevels.dat
Resource
win10v2004-20231023-es
Behavioral task
behavioral18
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/CantLetGo.mp3
Resource
win10v2004-20231023-es
Behavioral task
behavioral19
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/Clubstep.mp3
Resource
win10v2004-20231023-es
Behavioral task
behavioral20
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/Clutterfunk.mp3
Resource
win10v2004-20231020-es
Behavioral task
behavioral21
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/Cycles.mp3
Resource
win10v2004-20231023-es
Behavioral task
behavioral22
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DJRubRub.mp3
Resource
win10v2004-20231020-es
Behavioral task
behavioral23
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/Deadlocked.mp3
Resource
win10v2004-20231023-es
Behavioral task
behavioral24
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DryOut.mp3
Resource
win10v2004-20231020-es
Behavioral task
behavioral25
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DungeonSheet-hd.xml
Resource
win10v2004-20231023-es
Behavioral task
behavioral26
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DungeonSheet-hd.png
Resource
win10v2004-20231023-es
Behavioral task
behavioral27
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DungeonSheet-uhd.xml
Resource
win10v2004-20231020-es
Behavioral task
behavioral28
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DungeonSheet-uhd.png
Resource
win10v2004-20231023-es
Behavioral task
behavioral29
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DungeonSheet.xml
Resource
win10v2004-20231023-es
Behavioral task
behavioral30
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/DungeonSheet.png
Resource
win10v2004-20231023-es
Behavioral task
behavioral31
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/ElectroFrontlines.mp3
Resource
win10v2004-20231023-es
Behavioral task
behavioral32
Sample
Geometry Dash v2.11/Geometry Dash v2.11/Resources/Electrodynamix.mp3
Resource
win10v2004-20231023-es
General
-
Target
Geometry Dash v2.11/Geometry Dash v2.11/Resources/BeastMode.mp3
-
Size
540KB
-
MD5
2832823684b9aa4be280285e85813d36
-
SHA1
77754cfabc32e0d9f503b8c5410a1d0a0ecbc098
-
SHA256
7f26d4f65c7d3901108c608300e9fcded9a51c8abecd52767d363d01957c5773
-
SHA512
cc4a6e974d94c08672e8b679afecdae96ce05179dbdb2cf1c671b4e41e680cd7919ce047687d314fab2888109231fd1f45ccd5b8bdd827ec9bf1ea0fc74c48cc
-
SSDEEP
12288:3U4KV3hYlwKdj3nVcjVSIFun1gOFU8EHiSZEj8e/30t:95uKhFcgIPiU8MiSZwst
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1368 unregmp2.exe Token: SeCreatePagefilePrivilege 1368 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4876 2408 wmplayer.exe 81 PID 2408 wrote to memory of 4876 2408 wmplayer.exe 81 PID 2408 wrote to memory of 4876 2408 wmplayer.exe 81 PID 2408 wrote to memory of 1040 2408 wmplayer.exe 82 PID 2408 wrote to memory of 1040 2408 wmplayer.exe 82 PID 2408 wrote to memory of 1040 2408 wmplayer.exe 82 PID 1040 wrote to memory of 1368 1040 unregmp2.exe 83 PID 1040 wrote to memory of 1368 1040 unregmp2.exe 83
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Geometry Dash v2.11\Geometry Dash v2.11\Resources\BeastMode.mp3"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Geometry Dash v2.11\Geometry Dash v2.11\Resources\BeastMode.mp3"2⤵PID:4876
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD58ce9831e17c369b5305ef8e915789bf4
SHA16c76553bb95eb3145fa271a20b2ca9ab3d5708d7
SHA2561777b2e1ee102bb79731a084ee8ff7800babdb993be96f485c220d229c1fa634
SHA512c1cbc7ba6c60000040e4d4ff9789f4f12dd691faab035958f8a0f9a4110e573c35f00c50c7a260459d32c1de0a49b969adff41dab0f2dfd65a2c10ce73882d3f
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD56889521484d6de8cd1980f39f7241ced
SHA1a6dc2146e24938f75511eea9587d74e5ef61d980
SHA25634c3bc2aaeb02b0869d4f5533eb897879e29b1203c6304e13510a50bb5791492
SHA512c9e46cf88e4fefd505771c180166a788846edc3919ca9538bfdbd83559305a929fa84345d68e5aa9515c987077b4712823138dded2544f7016ce6bc524e4ff41