Analysis
-
max time kernel
173s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2025, 17:18
Behavioral task
behavioral1
Sample
ExodusWallet.zip
Resource
win10v2004-20250313-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
ExodusWallet.zip
Resource
win11-20250313-en
windows11-21h2-x64
0 signatures
150 seconds
General
-
Target
ExodusWallet.zip
-
Size
12.0MB
-
MD5
2472b364203ed098f6b8161ebf1df0c5
-
SHA1
26a702b42f6b9b32c6fddcfb024fdbecf2ba2f60
-
SHA256
1215214202d4b3103b6b88470dad2ce0836062703b040ac6a4cdfb4e97bcaa06
-
SHA512
6c9da01c03ddf9040ea4e8016e34bdff2e380ada298c198a9255b28673c71cc4298648a81c4c19cc476b3aef0e7d2cec9887094b8a21fc39fd781d0df4c620af
-
SSDEEP
393216:ZOHNU+3jtX4w1bzNTAorDGt36R0D7hGR/o/yW:Qt7jtX7/TAorDUk+7uvW
Malware Config
Extracted
Family
quasar
Version
1.4.1
Botnet
larpvault
C2
195.177.94.58:7000
Mutex
7e03e3fb-22c0-4bc3-91c5-b78b68c8c267
Attributes
-
encryption_key
0DE96920F31CF665B8020E803D1D5541E1FEA3E5
-
install_name
Client.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Modded Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral1/memory/2856-1-0x0000000000850000-0x0000000000908000-memory.dmp family_quasar -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000_Classes\Local Settings OpenWith.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 960 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 2856 ExodusLoader.exe Token: SeDebugPrivilege 1832 ExodusLoader.exe Token: SeDebugPrivilege 1168 taskmgr.exe Token: SeSystemProfilePrivilege 1168 taskmgr.exe Token: SeCreateGlobalPrivilege 1168 taskmgr.exe Token: SeDebugPrivilege 4224 ExodusLoader.exe Token: SeDebugPrivilege 1512 ExodusLoader.exe Token: SeDebugPrivilege 5272 ExodusLoader.exe Token: SeDebugPrivilege 1544 ExodusLoader.exe Token: SeDebugPrivilege 5640 ExodusLoader.exe Token: SeDebugPrivilege 5048 ExodusLoader.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe 1284 OpenWith.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1284 wrote to memory of 960 1284 OpenWith.exe 128 PID 1284 wrote to memory of 960 1284 OpenWith.exe 128
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ExodusWallet.zip1⤵PID:5640
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5892
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1168
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4224
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5272
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5640
-
C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"C:\Users\Admin\Desktop\ExodusWallet\ExodusLoader.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5048
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\ExodusWallet\Exodus.dll2⤵
- Opens file in notepad (likely ransom note)
PID:960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5baf55b95da4a601229647f25dad12878
SHA1abc16954ebfd213733c4493fc1910164d825cac8
SHA256ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924
SHA51224f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545