8d14c56913f9536ce1d44673b124d74315fee68afbba54c0c4a96ed552b6bc41

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
geode-installer-v5.11.2-win.exe
Size 46.8MB
Sample261020-rmtccsax21
SHA256 8d14c56913f9536ce1d44673b124d74315fee68afbba54c0c4a96ed552b6bc41
MD5 3c081468fbac879ed6122c8e4b405122
SHA1 6e771da010eade731fd7f3b21bf3a0c05bf0155e
SHA512 a7510ab601c4223ad578052cef863ffd6484ca22798742775a0bc3a760592f8ea6d7a60b15a79cadde4ddb116f2b81df277c45d69e04a4db22934c7dbcb32d5c
SSDEEP 786432:nqMmGVztbiaLivCLSydmYNQjh+YZqlL9XzJiMTLaGZh2bVTrnUrU/4e12UUcheBO:nqm1t2aLivSSqYZCpDQMTLaGZWKmlRY4
TLSH
T1B1B733217D51B12CDE2129FC6F9191EF9AB58AD00F103647871A8FE29E36B65FB0D1B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
4284	geode-installer-v5.11.2-win.exe
4284	geode-installer-v5.11.2-win.exe
4284	geode-installer-v5.11.2-win.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geode-installer-v5.11.2-win.exe

C:\Users\Admin\AppData\Local\Temp\geode-installer-v5.11.2-win.exe
"C:\Users\Admin\AppData\Local\Temp\geode-installer-v5.11.2-win.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfE893.tmp\LangDLL.dll
Size 8KB
SHA256 2e08e077a0800ec39c0596f4dd91cbbfa917eeef2d75a00767917b8d1f6884ac
MD5 313661ec12ed5ce1fd0b3292bf02cb69
SHA1 fd341676cf680a9f0f690c35b43feadc0693e9a8
SHA512 a16f35c6019eb1431a3d03fb7d0935c272756f2a8363f541e168a55b2e20a85ee90191715c845ab0588eef8f2af6cf91ac75c5bf1a5d0c61c513339006da9ff2
SSDEEP 96:b0nLo47eYkrGj23kBTPEa8ir2qUuRkNB/RMZCabEO/2/HdNfdpX2N:KoZYkrGj20tEEeYkv/RaCA/2/9h2N
TLSH
T13402D6DEFF0959F5C83395344096F25FC51D7426CA3B0E46EE1B0629BA2A9FC2A0D206
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfE893.tmp\System.dll
Size 28KB
SHA256 b89448b9fd7be5ef215cac6d973a57c0e75e1fffa25552afe174855c9b71fdf9
MD5 81e34f1c4b04a15dbce200c52f598f67
SHA1 f40a922ad7a5494e2aeeaa2b961d96738e888af7
SHA512 577f52a292075269f0e8ec4c6d243b2ed411872e009839553020929a8263174ad97943f150543e4ea6cb327d95e227f4065441a9d2106b7cabf1cb872dbcc181
SSDEEP 384:xmEs6sVqQq0DwRiGUaLYuAXLaMoy4m973uwYkvZ6YfkzB8yy1Eiu8ILvFd/9:xmEwqZ2wRiGUcY8TBsdvEbB8yyvIJ
TLSH
T1DFD20A2AFF06C8F2D1B1D570889EE677C526782957220E7BFF1B9E4CFC236825A19105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsfE893.tmp\modern-wizard.bmp
Size 201KB
SHA256 4873a57c9b2d697e4f8689ff7a2f785fb836a6289bc377320987b5541856234c
MD5 3c5626cfc549b9a2fc147f84601a68b1
SHA1 df2015ab7aa2eb9943cc5929fb9f7ec14a26b71e
SHA512 b076a7c5350a8fda2f641c052bab4f87a602f313c91a3c0ceab2da45f9753cd89ee97497a5c67552e65a97de1366e69bfc531f6b728224e86314b90b91fd9511
SSDEEP 384:Gx1uncOx0y1ARSzKyHOTEdWTBSYY0Z9XENc5iXbu8naAQHmUn0R/V8jQ1P6g1PKF:0uxVMsf8EbFGHmLRt8jQ1iE95CP
TLSH
T18114E0EC7FDDC8D1F21AF83871651B08C87B88DA1A03145CDABE946F93AC694B5C7621
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfE893.tmp\nsDialogs.dll
Size 14KB
SHA256 778b2bfbf3f4e641161f40c8174442a4d3865f097e3a2a383356dbfcac8005ab
MD5 2726673c720a296442c8ed134b41d169
SHA1 b8050c85017fcda78f6b82cc86ad277bb0dbd539
SHA512 95fd8cd96a4c627dfc1a89a98630ead3fe431360ab15f2324a52fdd03b2b493bdc44a4d6d0189276826725ea4e48aeb4711459a459b92a80be51e9431b70bb0b
SSDEEP 192:clWWck581HwPRLG/CocFR1w5nEYkv/RGl5BoiS+6SZSM3CU:Hdk5SoRLG/CocFR62Ykv8l5BoiFXyU
TLSH
T16252E50EFB0A44F6C572D834548BE72F869DA415C66F4E0AEF170B0CBDA32B5280E346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4284-22-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4284-16-0x0000000074960000-0x000000007496C000-memory.dmp

Download

memory/4284-0-0x0000000000439000-0x000000000043A000-memory.dmp

Download

memory/4284-15-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4284-23-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4284-24-0x0000000074960000-0x000000007496C000-memory.dmp

Download

memory/4284-25-0x0000000074240000-0x000000007424F000-memory.dmp

Download

memory/4284-26-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/4284-27-0x0000000000400000-0x000000000046E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads