b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd

Analysis

max time kernel
900s
max time network
503s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 07:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Geometry.Dash.v2.2081/Geometry.Dash.v2.2081/_Redist/oalinst.exe
Size 790KB
Sample260910-jasw3asxft
SHA256 b8f39714d41e009f75efb183c37100f2cbabb71784bbd243be881ac5b42d86fd
MD5 694f54bd227916b89fc3eb1db53f0685
SHA1 21fdc367291bbef14dac27925cae698d3928eead
SHA512 55bc0de75a7f27f11eb8f4ee8c9934dfe1acd044d8b7b2151c506bdcbead3ab179df7023f699c9139c77541bbc4b1c0657e93c34a6bc4309b665c6cb7636a7e5
SSDEEP 12288:0s1yfEcpPzdv+t4cRIy3ze3SUN0PXGTjiqRy2p3kwzjGHTkV:NwfLrvi4cRIyDe3SUNaXy+WypoGHgV
TLSH
T1E005F10020D5CC73E4EB32B3843586746EBA7E912F0A285B7FC476AEE673176DA71215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tmp7219.tmp	oalinst.exe
File created	C:\Windows\SysWOW64\OpenAL32.new	oalinst.exe
File created	C:\Windows\SysWOW64\wrap_oal.new	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\tmp8BBE.tmp	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\tmp721A.tmp	oalinst.exe
File created	C:\Windows\system32\OpenAL32.new	oalinst.exe
File created	C:\Windows\system32\wrap_oal.new	oalinst.exe
File opened for modification	C:\Windows\SysWOW64\tmp8BBF.tmp	oalinst.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe
File opened for modification	C:\Program Files (x86)\OpenAL\oalinst.exe	oalinst.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oalinst.exe

C:\Users\Admin\AppData\Local\Temp\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\oalinst.exe
"C:\Users\Admin\AppData\Local\Temp\Geometry.Dash.v2.2081\Geometry.Dash.v2.2081\_Redist\oalinst.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4724

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OpenAL32.dll

Path C:\Windows\SysWOW64\OpenAL32.dll
Size 106KB
SHA256 1797d150a2e23af4f390f5c33eb598c6f58d0454011d74941f5316add900bbdd
MD5 235355a8dd26903e75d5e812ecf50e53
SHA1 8316319341a0f9054e19e4a7b21df3dc49386fee
SHA512 5beb9343028790f993d0acb1007fd112b7e2ef6f9fbedfdb62b0140d2bbadf3b6368417ea19edb0bc8674d19418e5784fef4430ce1c329de8e83c304706d39ac
SSDEEP 1536:xYf99QAGcIq+pNocP6YI60qlW+kNvsy/mSvIfttnuQm6A41NbApkh:Hq+pKcPdUqWsyRIfttnu/y1Zk+
TLSH
T1B4B36C51FF824032E0C58E3D81A5CB969BBF19137F9254CBDF7419C85AA03D80A7A7E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\SysWOW64\wrap_oal.new
Size 434KB
SHA256 a4e46e6d09c4b0966824a2f6628ebf738e813672692a52a0d63d982e1030ef4f
MD5 d494267bc169604fac5e3679b9a97fed
SHA1 c093ce5a4f7dc40f7f604945bd1facfb2c805c4b
SHA512 7cfcfb570ecfa974054b5285c7d6ad3bccf502866ea70789750c3748394cb0991d1fa6dec9c50a506dbc697953663ec2605277a4451098bb8cd6699c4e506040
SSDEEP 6144:0AswvHbkHO2Qc7h3Ckr6A6u35n4boFnugPoHy5AObO5rvbykp:0A9qNyin35n4WugPoEc9ykp
TLSH
T116949E01E591C0F3C4AA48785873975A6B790F6113B9E9F3FFF03C9A9E602E4553624E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenAL32.new

Path C:\Windows\System32\OpenAL32.new
Size 120KB
SHA256 87802322c8e63555c26fe473ce234ce7099745ccb28c02766c2224c726454039
MD5 2ad7b4f3c8d2bb686d231edff404b7a4
SHA1 f29676b96d04bd2765925a3834d9babfdce6a0b3
SHA512 51a6c8cfe30e34c37437e6c5f8c602aa0759b65559a82521e2dbcf8a9865b826077854acb6497df6085d67b4c66083ae5f0f192b743a4b6f77ce7b18f01bf528
SSDEEP 3072:mQG3kfDcDKLIjVUl4ZjxNP7ZOqCA48gstZLsFusbdLakZ:ejsxlUVZ7ZOPstm1YkZ
TLSH
T1C9C36BE2715510F9D4EFA378C9A20682D37278249B21A3CF676081562F63BD8BFBD714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrap_oal.new

Path C:\Windows\System32\wrap_oal.new
Size 455KB
SHA256 5379373cf3eff41cdd8c912c65e27e1bd492bd84238d19a093aa846c9b1ce909
MD5 549347bcd4aacd63243d78e8f869dbb1
SHA1 efc00d2a7c5acfe17b8a58023826e6840aef39a6
SHA512 c6789376d05deb8c5050225c37c023055c107a72b49afddfd3f91e7e7429d38db9346e2e5d38986c2000c3828389cfbe5d74d80423a79eebd0367bcc81137cd5
SSDEEP 6144:ING0FBd3thlYIhSJyYvb3ahwNDx/+IJcaxjCz0G5suFrtxZO+jTyWQqlMfhGy6We:ILVkoWTNV/Qz0vWtxRHQqlM/kb
TLSH
T153A47C91E19184FAD1ABE1349A52AA17F7397C440B3847CB43B0A8711BE3BE469FF354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads