25e68fc4be38da3622d5a86e21a46c5270c21b18aab8066ed5c52b2917471820

Sharing

Copy URL

Twitter E-mail

General

Target

geode-installer-v2.0.0-beta.15-win.exe
Size

27.7MB
Sample

240207-ejrcdache2
MD5

2997d9220e258dbf40a5c99500160834
SHA1

c0881942e181395ec608e4c48c91c9c7fbf562f2
SHA256

25e68fc4be38da3622d5a86e21a46c5270c21b18aab8066ed5c52b2917471820
SHA512

782cab24ced5b81487e99d84e384aaa8546dee684434152cb1ed42b5081596ece73d090c0b0329cc69f2263de55281e5217315101d7bf3acb0205d90802c675a
SSDEEP

786432:WAqFNFeciZcof2fGWd+9QE2PINvyJLM4iBntXB7Ep+zJfKcf2zuP9q:W9FPIffss6duvyJLMTBntXB7E4zH289q

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  geode-installer-v2.0.0-beta.15-win.exe
- Size
  
  27.7MB
- MD5
  
  2997d9220e258dbf40a5c99500160834
- SHA1
  
  c0881942e181395ec608e4c48c91c9c7fbf562f2
- SHA256
  
  25e68fc4be38da3622d5a86e21a46c5270c21b18aab8066ed5c52b2917471820
- SHA512
  
  782cab24ced5b81487e99d84e384aaa8546dee684434152cb1ed42b5081596ece73d090c0b0329cc69f2263de55281e5217315101d7bf3acb0205d90802c675a
- SSDEEP
  
  786432:WAqFNFeciZcof2fGWd+9QE2PINvyJLM4iBntXB7Ep+zJfKcf2zuP9q:W9FPIffss6duvyJLMTBntXB7E4zH289q
Score

7^/10

discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  50016010fb0d8db2bc4cd258ceb43be5
- SHA1
  
  44ba95ee12e69da72478cf358c93533a9c7a01dc
- SHA256
  
  32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
- SHA512
  
  ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
- SSDEEP
  
  48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL
Score

3^/10
behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  4add245d4ba34b04f213409bfe504c07
- SHA1
  
  ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA256
  
  9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- SHA512
  
  1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP
  
  192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
Score

3^/10
behavioral3
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  1d8f01a83ddd259bc339902c1d33c8f1
- SHA1
  
  9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA256
  
  4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- SHA512
  
  28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP
  
  96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
Score

3^/10
behavioral4
- Target
  
  Geode.dll
- Size
  
  6.0MB
- MD5
  
  78f2bdbe9ab98becbc1d6aa4b6b7b9cc
- SHA1
  
  bd65f0b477849f590e66e841c8ab138d9013effc
- SHA256
  
  b1a16a2ff339503d9249bc05d92f09cda96b7e720fe12dcac18c853169f8e5a6
- SHA512
  
  5318d79d9fc3985b217f540e4431e62c44fdbdbccacfa5a18838295c717b3223fbbbe0e9cef81de9bc6f4fd74d464a4acfd7ed0200c18b8c90fee651b4858b82
- SSDEEP
  
  49152:K5Kef7WVrZ10DkXHxCrCMF10U1q64CTbzvSK0kgz:AKef7WkkXRcCsRA64yb7SK0
Score

1^/10
behavioral5
- Target
  
  GeodeUninstaller.exe
- Size
  
  81KB
- MD5
  
  5ccaefdb7e67dd8b9fbb90094aa3e148
- SHA1
  
  495560a397f5c0fa9b437c1f3e5755703abf5635
- SHA256
  
  9b37849231a7ac5d628224b80b723b4c85825c3864be9c5385d6641e95d2339f
- SHA512
  
  bdf9be1452a42654fec573a47f13189209b359fe3273f6e1db5310d83bd7a6ea06841959061570e346ef38c6ce1673ccdb34d09eedd2d0cb0d5bc4c9cf41056a
- SSDEEP
  
  1536:8ferrLkSRoe8C4UZsys0Dh1dugmCOYYB4y50BQFX7IS0hyv4uL7010n6BBF4:8fi3k+oWDBDh1duLCOYYmPhGN70+n6Xu
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral6
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  50016010fb0d8db2bc4cd258ceb43be5
- SHA1
  
  44ba95ee12e69da72478cf358c93533a9c7a01dc
- SHA256
  
  32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
- SHA512
  
  ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
- SSDEEP
  
  48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL
Score

3^/10
behavioral7
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  4add245d4ba34b04f213409bfe504c07
- SHA1
  
  ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
- SHA256
  
  9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
- SHA512
  
  1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
- SSDEEP
  
  192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
Score

3^/10
behavioral8
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  1d8f01a83ddd259bc339902c1d33c8f1
- SHA1
  
  9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
- SHA256
  
  4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
- SHA512
  
  28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
- SSDEEP
  
  96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
Score

3^/10
behavioral9
- Target
  
  GeodeUpdater.exe
- Size
  
  41KB
- MD5
  
  1d51dac6c3890010c0010fc8c4b48232
- SHA1
  
  3008859bc3af88fb7ba327c12e3c5d9491abd07a
- SHA256
  
  8a6f71e598ed9adff11f094616a33babadbf0700f7c4653792ea3083273867e6
- SHA512
  
  15c106f6d67a8c0c711fc6b50b7f9eabf4c57d36a78010e9165b03ed0eb20838d942609fc410486b5019f76de504663dd2a14a68469a88fc51969a0ff91812ee
- SSDEEP
  
  768:GNPNhHQRu/pfPo2naJpWODS05R6EpWXB3:GhNhHQRig2abD96FB3
Score

1^/10
behavioral10
- Target
  
  VC_redist.x86.exe
- Size
  
  13.2MB
- MD5
  
  9882a328c8414274555845fa6b542d1e
- SHA1
  
  ab4a97610b127d68c45311deabfbcd8aa7066f4b
- SHA256
  
  510fc8c2112e2bc544fb29a72191eabcc68d3a5a7468d35d7694493bc8593a79
- SHA512
  
  c08d1aa7e6e6215a0cee2793592b65668066c8c984b26675d2b8c09bc7fee21411cb3c0a905eaee7a48e7a47535fa777de21eeb07c78bca7bf3d7bb17192acf2
- SSDEEP
  
  196608:oRjgvJ2flpQcIIS/Rj7BWl+aV8t8z72BxBwBgO42BE6+2DQlMp1sHW5ZDmCCM0Xr:IgRIlptVYmfr7yBG/4pXMHsHW76CsGE
Score

4^/10

discovery
behavioral11
- Target
  
  XInput9_1_0.dll
- Size
  
  9KB
- MD5
  
  6b490c3e369bdedceca6ffb2a29655f4
- SHA1
  
  1bd1f2a3b96c167d6ca02b05ffaf80ff3039d124
- SHA256
  
  630e321c8f13cd3b2e5ad43fc23139d45a4cbbc00d634b8eaed0ae3b90f5dd4f
- SHA512
  
  18233b8c927a29c07609d5dbee56ac48dbba4df70723b7551ce1c5096c825fa61f829bf1483d63836a32e92ade8e9f5f51ac659e4823537b3de4dc7b32b6ff10
- SSDEEP
  
  192:YrgCXSxugfL1uLbDX1AWJfLJjOhZASAJljqt8:GTqLM7vJfdjgZASAi
Score

1^/10
behavioral12

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12