Analysis
- user interaction
yes - max time kernel
150s - max time network
125s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/10/2026, 14:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Exodium.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Exodium.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target Exodium.exe
- Size 16.8MB
- Sample261002-rt6w2a1ajc
- SHA256 51a76970bebde2dc2696ed771acf39b71ee2fcb10892ba9a1b7b3097b92f7a78
- MD5 ffb5838c0f5d71df3d6baf1a35dd3751
- SHA1 6d4cd36a5a11065b4eabe973c6e23799d1fe569b
- SHA512 2804bb457bf116856139b57a99853315df2a82bce325b24970b28f5aebf45f8ddae9238893d77b7eb8ea258a74fe279a9b5803bce3eb1caafb69702315073f0e
- SSDEEP 393216:wbzEFANLk9/UC1trdbZq3496DeAOJRDD0XivIaiPC:wnEFGC1tRFqI9Ie/DuEi6
- TLSH T101071206BAD0A3F8D497C630078717E9B0A13D4B97A69E6F36C53C016D32AD50E5E7A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs
pid Process 5096 Exodium.exe 5096 Exodium.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5096 Exodium.exe 5096 Exodium.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exodium.exe"C:\Users\Admin\AppData\Local\Temp\Exodium.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5672