c99a836641747c595f823613f54d27e27362d0901d45425444cbfac6779b793e

Analysis

max time kernel
598s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Exodus/exodus.wallet/info.seco
Size 32KB
Sample260604-3f1nmsht7j
SHA256 c99a836641747c595f823613f54d27e27362d0901d45425444cbfac6779b793e
MD5 c0540b42b07874653eff2957d87c6c9c
SHA1 059f244437fa024f0a14464df05fe6e1f6084c2a
SHA512 6af5e6a459c50f1014f47ad898a33ad03d46d3829fd5e95b9eb428a1820f010812a8aacc764f66a134413d7b1b264bdce224effb6bee4eb5eb6baf9b7d13cf99
SSDEEP 768:M+srSBL3B5ofiUHY5lNVkpKRu4bZOKbKp4n5dwBb:M+59eRY1VNbpKp45dwB
TLSH
T1D7E2E15F930CBD55CC8DE5F39C7410B1251BBE67F22A1CADB42881CCA6BD2E221DE1A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access stealer

Malware Config

Signatures

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4100	OpenWith.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Exodus\exodus.wallet\info.seco
1⤵
- Modifies registry class
PID:4328

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads