20d6f0ac61ec820895ff25bc26558ddb877f37cc939d303257099ad5fc51e76c

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XInput1_4.dll
Size 49KB
Sample261020-rmtccsax21
SHA256 20d6f0ac61ec820895ff25bc26558ddb877f37cc939d303257099ad5fc51e76c
MD5 025b092cea9c873e28842ab8b3b0a60a
SHA1 a24615d9663ed30452b79a61e33caf821e0612f9
SHA512 be5ade23fcd16378495cb1637220a8f5207b3c96d3ad0d079ca3fa6d8cda44c33f35ba2c34484a3517b5a2f20af4f23e84bf77a8737a9ac0d9759e5027cf2d83
SSDEEP 768:P2sBAasvYxsgRcj4gitqIyEHNxzjuFGSl+7ra8EZWEIMFZFR:P2sBsCCQqKHNZMfWra7+MFZFR
TLSH
T1B03329057B9644ACC4E6C5B886570E921972B0CA0F32E6EF8381933D2E757F92F39791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	5528	GeodeUpdater.exe

Executes dropped EXE 2 IoCs

pid	Process
4420	geode_vc_redist.x64.exe
3540	geode_vc_redist.x64.exe

Loads dropped DLL 1 IoCs

pid	Process
3540	geode_vc_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geode_vc_redist.x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geode_vc_redist.x64.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 5528	1964	rundll32.exe	89
PID 5528 wrote to memory of 4420	5528	GeodeUpdater.exe	91
PID 4420 wrote to memory of 3540	4420	geode_vc_redist.x64.exe	92

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XInput1_4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\GeodeUpdater.exe
  GeodeUpdater.exe /redist
  2⤵
  - Downloads MZ/PE file
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Users\Admin\AppData\Local\Temp\geode_vc_redist.x64.exe
    "C:\Users\Admin\AppData\Local\Temp\geode_vc_redist.x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\Temp\{28DC4305-D14D-46E8-96EE-65FC926CA0DA}\.cr\geode_vc_redist.x64.exe
      "C:\Windows\Temp\{28DC4305-D14D-46E8-96EE-65FC926CA0DA}\.cr\geode_vc_redist.x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\geode_vc_redist.x64.exe" -burn.filehandle.attached=752 -burn.filehandle.self=756
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VC_redist.x64[1].exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KPC5UXGI\VC_redist.x64[1].exe
Size 17.9MB
SHA256 843068991daaa1f73ad9f6239bce4d0f6a07a51f18c37ea2a867e9beca71295c
MD5 8da7373f3ec287fe1c3ad72a7b2922f0
SHA1 46adcdfbe9aebe767657b7a802cc366f827ced77
SHA512 c42c82cfd5eaa2165b600f6109cb14ff4308cdf4cff656a1375b4a933f1630bfe54c99c4d0fb9ed3bea4dc4e4fdaa3db8e7c58356cca07c2954f4c297757d62d
SSDEEP 393216:rCpQ/hbBWGW1tkWSz61gUM0SOm53TgypRvlxoMtBpMw4OrW:rCpQpbQ1tBj1gR0SP53tRvlLpM2K
TLSH
T133173332A4742132F6F16437F968F1307E3CA72863D09D99D3C8AD99396488267F725B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Windows\Temp\{2332A738-2E74-4873-93FF-E77B73C6A5E7}\.ba\logo.png
Size 1KB
SHA256 335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
MD5 d6bd210f227442b3362493d046cea233
SHA1 ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA512 464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
TLSH
T1CF312CF34748B7A7D30581351471819AD242FFD8F9CE291E35CD5307664018115C75CF
MD5 SHA1 SHA512 TLSH

Submit Download

wixstdba.dll

Path C:\Windows\Temp\{2332A738-2E74-4873-93FF-E77B73C6A5E7}\.ba\wixstdba.dll
Size 215KB
SHA256 e921f69b9fb4b5ad4691809d06896c5f1d655ab75e0ce94a372319c243c56d4e
MD5 f68f43f809840328f4e993a54b0d5e62
SHA1 01da48ce6c81df4835b4c2eca7e1d447be893d39
SHA512 a7a799ecf1784fb5e8cd7191bf78b510ff5b07db07363388d7b32ed21f4fddc09e34d1160113395f728c0f4e57d13768a0350dbdb207d9224337d2153dc791e1
SSDEEP 6144:K6EZdi6e93SuDeTKZxQfsRy26BqbUHYJe:K62i6eNSYeuZ2sRDK
TLSH
T15E24AF12B5D0907AEBFB19305939E5216DBDBA210FA0C9CE5348AD2B2E705C1DB36737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geode_vc_redist.x64.exe

Path C:\Windows\Temp\{28DC4305-D14D-46E8-96EE-65FC926CA0DA}\.cr\geode_vc_redist.x64.exe
Size 615KB
SHA256 dbcc159853d8b83c1df0a0a698127ab98e926af1b6dee86e96f541dc94b34948
MD5 2de7a2a87f61fd6ead5276047feaf36c
SHA1 d9a03aa94dfb0f485a9fd281d89d2edd499408f7
SHA512 ea8dac8d0cf79b2d8302a4405ba2d44be8dbca316038d90f19bce6d0760685105771e87b1e905ff58e6ee10e154ec9ad6c00fc575dd8c82ea4eed856fb5569ac
SSDEEP 12288:73mgqnIZuYfCYqFet4CovkM7RVYnE2EwCeYG1LM7d:73WnIZuMCxezot7rgd4e2d
TLSH
T1AAD48D32A5614033FBF105B3B928A6303E7CE728275188A9D7D4BD1D7EA84C1A7F7256
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads