Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2023 01:12
General
-
Target
Exudify/Exudify.exe
-
Size
338KB
-
MD5
20b61a58d7cfed8465718f10173636f2
-
SHA1
6a82be7188d1e7827f24c3ef2a605369075212ec
-
SHA256
0ea528ae0f3931379941f569ae55f0ec2c0714ccd1c2c36cc39e20ba58e11113
-
SHA512
473cf9aa35a38499b496a3ace758827e9e9d322fdafbb0d6fb4f7b1ec687b14f49bf2ae044d75dfc9e259dbe913ad4c1fec1777413abf882e349e9bec5f4c1eb
-
SSDEEP
3072:FUjcxsny6PMVCtDH1b6/bQSEII/ejywpVF1oXgPvak7ndBY:FSy6PMVAVbghEV/e+YoQ6kTD
Malware Config
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
exodus
45.154.98.42:4449
mtwqrwlcaqjp
-
delay
1
-
install
true
-
install_file
exudifyconfig.exe
-
install_folder
%AppData%
Signatures
-
Async RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/4952-133-0x0000000000E50000-0x0000000000EAA000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\exudifyconfig.exe asyncrat C:\Users\Admin\AppData\Roaming\exudifyconfig.exe asyncrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Exudify.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3259792829-1422303781-2047321929-1000\Control Panel\International\Geo\Nation Exudify.exe -
Executes dropped EXE 1 IoCs
Processes:
exudifyconfig.exepid process 3748 exudifyconfig.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2236 timeout.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Exudify.exeexudifyconfig.exepid process 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 4952 Exudify.exe 3748 exudifyconfig.exe 3748 exudifyconfig.exe 3748 exudifyconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Exudify.exeexudifyconfig.exedescription pid process Token: SeDebugPrivilege 4952 Exudify.exe Token: SeDebugPrivilege 3748 exudifyconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
exudifyconfig.exepid process 3748 exudifyconfig.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Exudify.execmd.execmd.exedescription pid process target process PID 4952 wrote to memory of 2644 4952 Exudify.exe cmd.exe PID 4952 wrote to memory of 2644 4952 Exudify.exe cmd.exe PID 4952 wrote to memory of 1320 4952 Exudify.exe cmd.exe PID 4952 wrote to memory of 1320 4952 Exudify.exe cmd.exe PID 2644 wrote to memory of 3512 2644 cmd.exe schtasks.exe PID 2644 wrote to memory of 3512 2644 cmd.exe schtasks.exe PID 1320 wrote to memory of 2236 1320 cmd.exe timeout.exe PID 1320 wrote to memory of 2236 1320 cmd.exe timeout.exe PID 1320 wrote to memory of 3748 1320 cmd.exe exudifyconfig.exe PID 1320 wrote to memory of 3748 1320 cmd.exe exudifyconfig.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exudify\Exudify.exe"C:\Users\Admin\AppData\Local\Temp\Exudify\Exudify.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "exudifyconfig" /tr '"C:\Users\Admin\AppData\Roaming\exudifyconfig.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "exudifyconfig" /tr '"C:\Users\Admin\AppData\Roaming\exudifyconfig.exe"'3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp745A.tmp.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 33⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\exudifyconfig.exe"C:\Users\Admin\AppData\Roaming\exudifyconfig.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp745A.tmp.batFilesize
157B
MD5e7e919e61f539a4f8037ff86760cb70c
SHA1ed66004f4dd2360bf8b65d759342d078601c30e9
SHA2562252fdd90a842f4affeaf1976231ad78630e8c09ea2045c6e532993db0e599c0
SHA512f02e3b3d8d52c73868a6eea2f0793ed20e97867f00ff9873b255f3191ea4ea7b814deb96df5ac8a467e7926da78d7c069b53bdea726d2533de37fab179a0a45a
-
C:\Users\Admin\AppData\Roaming\MyData\DataLogs.confFilesize
8B
MD5cf759e4c5f14fe3eec41b87ed756cea8
SHA1c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA256c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
SHA512c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
-
C:\Users\Admin\AppData\Roaming\exudifyconfig.exeFilesize
338KB
MD520b61a58d7cfed8465718f10173636f2
SHA16a82be7188d1e7827f24c3ef2a605369075212ec
SHA2560ea528ae0f3931379941f569ae55f0ec2c0714ccd1c2c36cc39e20ba58e11113
SHA512473cf9aa35a38499b496a3ace758827e9e9d322fdafbb0d6fb4f7b1ec687b14f49bf2ae044d75dfc9e259dbe913ad4c1fec1777413abf882e349e9bec5f4c1eb
-
C:\Users\Admin\AppData\Roaming\exudifyconfig.exeFilesize
338KB
MD520b61a58d7cfed8465718f10173636f2
SHA16a82be7188d1e7827f24c3ef2a605369075212ec
SHA2560ea528ae0f3931379941f569ae55f0ec2c0714ccd1c2c36cc39e20ba58e11113
SHA512473cf9aa35a38499b496a3ace758827e9e9d322fdafbb0d6fb4f7b1ec687b14f49bf2ae044d75dfc9e259dbe913ad4c1fec1777413abf882e349e9bec5f4c1eb
-
memory/3748-145-0x000000001BC20000-0x000000001BC30000-memory.dmpFilesize
64KB
-
memory/3748-146-0x000000001BC20000-0x000000001BC30000-memory.dmpFilesize
64KB
-
memory/3748-147-0x000000001BC20000-0x000000001BC30000-memory.dmpFilesize
64KB
-
memory/3748-148-0x000000001BC20000-0x000000001BC30000-memory.dmpFilesize
64KB
-
memory/3748-149-0x000000001BC20000-0x000000001BC30000-memory.dmpFilesize
64KB
-
memory/3748-150-0x000000001BC20000-0x000000001BC30000-memory.dmpFilesize
64KB
-
memory/4952-133-0x0000000000E50000-0x0000000000EAA000-memory.dmpFilesize
360KB
-
memory/4952-135-0x00000000018C0000-0x00000000018D0000-memory.dmpFilesize
64KB