Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3GoDm (3).zip
windows10-2004-x64
7GoDm/.git/...sample
windows10-2004-x64
3GoDm/.git/...sample
windows10-2004-x64
3GoDm/.git/...sample
windows10-2004-x64
3GoDm/.git/...sample
windows10-2004-x64
3GoDm/.git/index
windows10-2004-x64
1GoDm/.git/...xclude
windows10-2004-x64
1GoDm/.git/logs/HEAD
windows10-2004-x64
1GoDm/.git/...s/main
windows10-2004-x64
1GoDm/.git/...n/HEAD
windows10-2004-x64
1GoDm/.git/...d5.idx
windows10-2004-x64
3GoDm/.git/...5.pack
windows10-2004-x64
3GoDm/.git/packed-refs
windows10-2004-x64
1GoDm/.git/...s/main
windows10-2004-x64
1GoDm/.git/...n/HEAD
windows10-2004-x64
1GoDm/README.md
windows10-2004-x64
3GoDm/clien...ect.go
windows10-2004-x64
3GoDm/client/cookie.go
windows10-2004-x64
3GoDm/client/errors.go
windows10-2004-x64
3GoDm/config.json
windows10-2004-x64
3GoDm/data/valid.txt
windows10-2004-x64
1GoDm/errors.txt
windows10-2004-x64
1GoDm/go.mod
windows10-2004-x64
6GoDm/go.sum
windows10-2004-x64
3GoDm/scrap...per.go
windows10-2004-x64
3GoDm/scrap...cts.go
windows10-2004-x64
3GoDm/src/R...vendor
windows10-2004-x64
3GoDm/src/client.go
windows10-2004-x64
3GoDm/src/headers.go
windows10-2004-x64
3GoDm/src/massdm.go
windows10-2004-x64
3GoDm/src/modules.js
windows10-2004-x64
1GoDm/src/structs.go
windows10-2004-x64
3Analysis
-
max time kernel
806s -
max time network
1168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
04/02/2024, 09:51
Static task
static1
Behavioral task
behavioral1
Sample
GoDm (3).zip
Resource
win10v2004-20231222-en
Behavioral task
behavioral2
Sample
GoDm/.git/hooks/applypatch-msg.sample
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
GoDm/.git/hooks/commit-msg.sample
Resource
win10v2004-20231222-en
Behavioral task
behavioral4
Sample
GoDm/.git/hooks/fsmonitor-watchman.sample
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
GoDm/.git/hooks/post-update.sample
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
GoDm/.git/index
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
GoDm/.git/info/exclude
Resource
win10v2004-20231215-en
Behavioral task
behavioral8
Sample
GoDm/.git/logs/HEAD
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
GoDm/.git/logs/refs/heads/main
Resource
win10v2004-20231222-en
Behavioral task
behavioral10
Sample
GoDm/.git/logs/refs/remotes/origin/HEAD
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
GoDm/.git/objects/pack/pack-9dc5098392533d81805be817b6915391f7ab36d5.idx
Resource
win10v2004-20231215-en
Behavioral task
behavioral12
Sample
GoDm/.git/objects/pack/pack-9dc5098392533d81805be817b6915391f7ab36d5.pack
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
GoDm/.git/packed-refs
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
GoDm/.git/refs/heads/main
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
GoDm/.git/refs/remotes/origin/HEAD
Resource
win10v2004-20231215-en
Behavioral task
behavioral16
Sample
GoDm/README.md
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
GoDm/client/connect.go
Resource
win10v2004-20231215-en
Behavioral task
behavioral18
Sample
GoDm/client/cookie.go
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
GoDm/client/errors.go
Resource
win10v2004-20231215-en
Behavioral task
behavioral20
Sample
GoDm/config.json
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
GoDm/data/valid.txt
Resource
win10v2004-20231215-en
Behavioral task
behavioral22
Sample
GoDm/errors.txt
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
GoDm/go.mod
Resource
win10v2004-20231222-en
Behavioral task
behavioral24
Sample
GoDm/go.sum
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
GoDm/scraper/scraper.go
Resource
win10v2004-20231222-en
Behavioral task
behavioral26
Sample
GoDm/scraper/structs.go
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
GoDm/src/README.vendor
Resource
win10v2004-20231215-en
Behavioral task
behavioral28
Sample
GoDm/src/client.go
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
GoDm/src/headers.go
Resource
win10v2004-20231215-en
Behavioral task
behavioral30
Sample
GoDm/src/massdm.go
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
GoDm/src/modules.js
Resource
win10v2004-20231222-en
Behavioral task
behavioral32
Sample
GoDm/src/structs.go
Resource
win10v2004-20231215-en
General
-
Target
GoDm/go.mod
-
Size
742B
-
MD5
dbf29b80c28efe845a6836bba5537801
-
SHA1
f2e9ded41346759149bb35e58a2000b88b91b329
-
SHA256
c273a49af6b3cc3a26790ee13978cd008e39945abaea46b5ce17e5582f5343a3
-
SHA512
eaa500ac014b67ce5b32383a24f74dd58774604df501fdb04599881b5073773dbb72051c504d85afa8e07a5551875d34932d48d17fbe3426be006eece487ef7d
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: unregmp2.exe File opened (read-only) \??\M: unregmp2.exe File opened (read-only) \??\W: unregmp2.exe File opened (read-only) \??\A: unregmp2.exe File opened (read-only) \??\H: unregmp2.exe File opened (read-only) \??\K: unregmp2.exe File opened (read-only) \??\X: unregmp2.exe File opened (read-only) \??\I: unregmp2.exe File opened (read-only) \??\J: unregmp2.exe File opened (read-only) \??\N: unregmp2.exe File opened (read-only) \??\O: unregmp2.exe File opened (read-only) \??\R: unregmp2.exe File opened (read-only) \??\T: unregmp2.exe File opened (read-only) \??\V: unregmp2.exe File opened (read-only) \??\Y: unregmp2.exe File opened (read-only) \??\B: unregmp2.exe File opened (read-only) \??\E: unregmp2.exe File opened (read-only) \??\L: unregmp2.exe File opened (read-only) \??\P: unregmp2.exe File opened (read-only) \??\Q: unregmp2.exe File opened (read-only) \??\S: unregmp2.exe File opened (read-only) \??\U: unregmp2.exe File opened (read-only) \??\Z: unregmp2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 3988 unregmp2.exe Token: SeCreatePagefilePrivilege 3988 unregmp2.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4092 wrote to memory of 952 4092 wmplayer.exe 88 PID 4092 wrote to memory of 952 4092 wmplayer.exe 88 PID 4092 wrote to memory of 952 4092 wmplayer.exe 88 PID 4092 wrote to memory of 2964 4092 wmplayer.exe 89 PID 4092 wrote to memory of 2964 4092 wmplayer.exe 89 PID 4092 wrote to memory of 2964 4092 wmplayer.exe 89 PID 2964 wrote to memory of 3988 2964 unregmp2.exe 90 PID 2964 wrote to memory of 3988 2964 unregmp2.exe 90
Processes
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "C:\Users\Admin\AppData\Local\Temp\GoDm\go.mod"1⤵
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:9 /Open "C:\Users\Admin\AppData\Local\Temp\GoDm\go.mod"2⤵PID:952
-
-
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon2⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT3⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:3988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5c374c25875887db7d072033f817b6ce1
SHA13a6d10268f30e42f973dadf044dba7497e05cdaf
SHA25605d47b87b577841cc40db176ea634ec49b0b97066e192e1d48d84bb977e696b6
SHA5126a14f81a300695c09cb335c13155144e562c86bb0ddfdcab641eb3a168877ad3fcc0579ad86162622998928378ea2ffe5a244b3ddbe6c11a959dbb34af374a7d
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD5241ecb07d55fab2cbc1945b156fc4a06
SHA1e554d622fe2a481213173119108ce5a376662970
SHA2561cc307f281f26abadccc53efa2beeaedf5024cc48b35e978535bafbd54e9f262
SHA5122b0210e225ce2d6cd5667cc0baa1cdc4d91d7538cc09d4b06e5c3320889aef2b1468321dd5981f709926f02261abcda113d58ae34f0607aba081b06f91dd8c2a