Resubmissions
05/08/2026, 01:46
260805-b62j3swbjg804/08/2026, 06:37
260804-hdnwvax1dz404/08/2026, 06:31
260804-hakp1sed69303/08/2026, 13:01
260803-p9kmmayekd803/08/2026, 12:56
260803-p6dd5shh338Analysis
- max time kernel
125s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 06:31
General
- Target Desktop Goose v0.31/DesktopGoose v0.31/GooseDesktop.exe
- Size 221KB
- Sample260804-hakp1sed69
- SHA256 943fd1ea44266c5d7fa02f2b292db095a4e6ba8027a1f6c73fd60d1165e63aff
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\GooseDesktop.exe"C:\Users\Admin\AppData\Local\Temp\Desktop Goose v0.31\DesktopGoose v0.31\GooseDesktop.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004A0 0x00000000000004A81⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5540-0-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/5540-1-0x00000000006C0000-0x00000000006FE000-memory.dmp
memory/5540-2-0x00000000051A0000-0x0000000005232000-memory.dmp
memory/5540-3-0x0000000005870000-0x0000000005E2A000-memory.dmp
memory/5540-5-0x00000000747E0000-0x0000000074F9C000-memory.dmp
memory/5540-4-0x00000000052C0000-0x00000000052CA000-memory.dmp
memory/5540-6-0x0000000005430000-0x000000000543A000-memory.dmp
memory/5540-7-0x00000000747F2000-0x00000000747F3000-memory.dmp
memory/5540-8-0x00000000747E0000-0x0000000074F9C000-memory.dmp