Overview
overview
7Static
static
3geode-inst...in.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Geode.dll
windows10-2004-x64
1GeodeUninstaller.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3GeodeUpdater.exe
windows10-2004-x64
1VC_redist.x86.exe
windows10-2004-x64
4XInput9_1_0.dll
windows10-2004-x64
1Analysis
-
max time kernel
92s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/02/2024, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
geode-installer-v2.0.0-beta.20-win.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral5
Sample
Geode.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral6
Sample
GeodeUninstaller.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240221-en
Behavioral task
behavioral10
Sample
GeodeUpdater.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral11
Sample
VC_redist.x86.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral12
Sample
XInput9_1_0.dll
Resource
win10v2004-20240221-en
General
-
Target
XInput9_1_0.dll
-
Size
11KB
-
MD5
d61fd9bf10f59713082cfc9a3accbf87
-
SHA1
d36a0129c846be9bd2a79af82a5a9af199f84ed8
-
SHA256
0222e64dc51dc14095e453b46b485834b0c81ae8ced850e7e7b52acf11bb723e
-
SHA512
595e73710bb567fd8be0ac130aac6334ae34bddca3e39c34322c7390947152d15a8717d30a6e923c6d48390312f42501f29436d6c73be59ed086d26362921c3d
-
SSDEEP
192:TQdcdW6Ss9HI23vSdZXShyWJT/BEaE+EgwijOyKaCwmPgbDLTGc:f/SspI2WgHJZlj/Ka/tvi
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1004 wrote to memory of 3668 1004 rundll32.exe 87 PID 1004 wrote to memory of 3668 1004 rundll32.exe 87 PID 1004 wrote to memory of 3668 1004 rundll32.exe 87