Overview

overview

7

Static

static

3

Exodus Updater.exe

windows10-2004-x64

7

Exodus Updater.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 12:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Exodus Updater.exe
  • Size 75.9MB
  • Sample260802-pjptnaan2t
  • SHA256 4880415549fff17622599bb067d5e965247378b41c7c1913afc23caf3bf6c319
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 53 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 1 TTPs 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Exodus Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\Exodus Updater.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2944
    • C:\Users\Admin\AppData\Local\Temp\Exodus Updater.exe
      "C:\Users\Admin\AppData\Local\Temp\Exodus Updater.exe"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:5308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        _raw_aes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\Cryptodome\Cipher\_raw_aes.pyd
        • Size 34KB
        • SHA256 889f9b558a47a4333bfd3e3814eaec2328ac8648722d912c7873fdea62fcf886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _cpuid_c.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\Cryptodome\Util\_cpuid_c.pyd
        • Size 10KB
        • SHA256 e7e6f27d5203768e6454b4066847a3af02548c811146da047c4a53b1edaf32e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\VCRUNTIME140.dll
        • Size 116KB
        • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VCRUNTIME140_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\VCRUNTIME140_1.dll
        • Size 48KB
        • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _asyncio.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_asyncio.pyd
        • Size 69KB
        • SHA256 7a5c88ce496bafdf31a94ae6d70b017070703bc0a7da1dfae7c12b21bb61030d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_bz2.pyd
        • Size 83KB
        • SHA256 324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_ctypes.pyd
        • Size 122KB
        • SHA256 8978972cf341ccd0edf8435d63909a739df7ef29ec7dd57ed5cab64b342891f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _hashlib.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_hashlib.pyd
        • Size 64KB
        • SHA256 f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_lzma.pyd
        • Size 156KB
        • SHA256 6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _overlapped.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_overlapped.pyd
        • Size 54KB
        • SHA256 46dec978ec8cb2146854739bfeddea93335dcc92a25d719352b94f9517855032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _queue.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_queue.pyd
        • Size 31KB
        • SHA256 76bba42b1392dc57a867aef385b990fa302a4f1dcf453705ac119c9c98a36e8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _socket.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_socket.pyd
        • Size 81KB
        • SHA256 2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _sqlite3.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_sqlite3.pyd
        • Size 122KB
        • SHA256 fb00951d39084e88871c813d6c4043ce8afb60ab6d012e699ddd607baa10f6e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ssl.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_ssl.pyd
        • Size 174KB
        • SHA256 68dad60ff6fb36c88ef1c47d1855517bfe8de0f5ddea0f630b65b622a645d53a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _wmi.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\_wmi.pyd
        • Size 36KB
        • SHA256 5818679010bb536a3d463eeee8ce203e880a8cd1c06bf1cb6c416ab0dc024d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\ada92cb5d92a588d1b93__mypyc.cp312-win_amd64.pyd
        • Size 222KB
        • SHA256 df5ea1b515f4e6677196f3d8c2f40a00b008d8e09152d08425f794e1b55f890d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\base_library.zip
        • Size 1.3MB
        • SHA256 b79c35960ec5fef015a4db1912f223dc63c7a3942f4b5cf373a42cbfd7efeaf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cd.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\charset_normalizer\cd.cp312-win_amd64.pyd
        • Size 10KB
        • SHA256 be1d8801c9785a52e5bc1b0c77ceca2c88041a5d9b9bac7162d767f712ea10e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\libcrypto-3.dll
        • Size 5.0MB
        • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\libffi-8.dll
        • Size 38KB
        • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\libssl-3.dll
        • Size 768KB
        • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _version.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\lz4\_version.cp312-win_amd64.pyd
        • Size 11KB
        • SHA256 a1d8664efed26257b07acfe77640db0a35389d17a5a70d7c623cae0db74dabc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _block.cp312-win_amd64.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\lz4\block\_block.cp312-win_amd64.pyd
        • Size 74KB
        • SHA256 d8c5d519e80ec7b517a1a6fa4b6cf905cfd9332ddc311b8f82adaaf0b9982372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\python3.DLL
        • Size 66KB
        • SHA256 29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\python312.dll
        • Size 6.6MB
        • SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pythoncom312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\pywin32_system32\pythoncom312.dll
        • Size 674KB
        • SHA256 18e5d69b62110f48da01842f9ddfd99d06cc561f0866371714ec6534fcb4e5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pywintypes312.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\pywin32_system32\pywintypes312.dll
        • Size 133KB
        • SHA256 9bd7f8c39a84d7b1ea43bfcd33c04631c60f4ff28167e82bb21987cc1c353766
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\select.pyd
        • Size 30KB
        • SHA256 678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Lorem ipsum.txt
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
        • Size 1KB
        • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\sqlite3.dll
        • Size 1.5MB
        • SHA256 809c7b48b73c95b361d13c753e7a6e3c83124a27e18aac81df7c876f32e98e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unicodedata.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\unicodedata.pyd
        • Size 1.1MB
        • SHA256 c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32api.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\win32\win32api.pyd
        • Size 135KB
        • SHA256 8e09d7aa57dc33b663afd219fab21b6a70e9d98cc74a044df4d6cd94799d98c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        win32event.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI29442\win32\win32event.pyd
        • Size 29KB
        • SHA256 a6b896456443447a663fe25783dfa95929dc8ade8d7970fd78d3b4e65100371e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5308-1152-0x00007FFBD6010000-0x00007FFBD934D000-memory.dmp
        Download