4657f15975998273e9eeb3a440d7437daffb933ace8874973b823063d5cca5ef

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 19:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
geode-installer-v5.2.0-win.exe
Size 44.8MB
Sample260703-ya4e5abx9j
SHA256 4657f15975998273e9eeb3a440d7437daffb933ace8874973b823063d5cca5ef
MD5 a9990e2adc0390de69ee91c12e463e1e
SHA1 d3542223b0a51d43897c0028acbd383eeb3148dd
SHA512 0920d051d52656c9b75e8c8f07dac9f4d6d143430f9409afd6dcf2f9dfb0c681094d323c1ab3574e74ca8b29125d64c3f2404c10d014df9f635846f4e91f2457
SSDEEP 786432:/6wDuFYibOEbt+Q4IkSXVynsVkFPrgZ+TplQCfVqLuv5cfRfKEXuGln7ZAOGZ:/6wDdN6kPIkGEhprltILrf7+Gln93O
TLSH
T159A733AD12F2D9B2F60173F98C84FAD93C065BBE284513769705B15C1CE08AFEB99712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
6128	geode-installer-v5.2.0-win.exe
6128	geode-installer-v5.2.0-win.exe
6128	geode-installer-v5.2.0-win.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geode-installer-v5.2.0-win.exe

C:\Users\Admin\AppData\Local\Temp\geode-installer-v5.2.0-win.exe
"C:\Users\Admin\AppData\Local\Temp\geode-installer-v5.2.0-win.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\LangDLL.dll
Size 8KB
SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
MD5 313661ec12ed5ce1fd0b3292bf02cb69
SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
TLSH
T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\System.dll
Size 28KB
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nshB013.tmp\nsDialogs.dll
Size 14KB
SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
MD5 2726673c720a296442c8ed134b41d169
SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
TLSH
T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6128-0-0x0000000000439000-0x000000000043A000-memory.dmp

Download

memory/6128-15-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/6128-16-0x0000000074150000-0x000000007415C000-memory.dmp

Download

memory/6128-22-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/6128-23-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/6128-25-0x0000000073A30000-0x0000000073A3F000-memory.dmp

Download

memory/6128-24-0x0000000074150000-0x000000007415C000-memory.dmp

Download

memory/6128-26-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/6128-27-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads