Analysis
- user interaction
yes - max time kernel
390s - max time network
393s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
27/10/2026, 03:03
General
- Target exodus-windows-x64-26.8.27.exe
- Size 89.2MB
- Sample261027-dkf3cs1tcv
- SHA256 3f95946fa559cee1cbc10b648c1347e1a7c894a334ba35b946ac56e5f675addc
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 64 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.8.27.exe"C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.8.27.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MW2IZ3QCIS.tmp\exodus-windows-x64-26.8.27.tmp"C:\Users\Admin\AppData\Local\Temp\is-MW2IZ3QCIS.tmp\exodus-windows-x64-26.8.27.tmp" /SL5="$4022A,92303576,1192448,C:\Users\Admin\AppData\Local\Temp\exodus-windows-x64-26.8.27.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Exodus\Exodus.exe"C:\Program Files\Exodus\Exodus.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cscript.exe"cscript.exe" //NoLogo "C:\Program Files\Exodus\config.vbs"4⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004C41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Exodus\Exodus.exe"C:\Program Files\Exodus\Exodus.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cscript.exe"cscript.exe" //NoLogo "C:\Program Files\Exodus\config.vbs"2⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Avalonia.Base.dll
Avalonia.Controls.dll
Avalonia.Desktop.dll
Avalonia.Fonts.Inter.dll
Avalonia.MicroCom.dll
Avalonia.OpenGL.dll
Avalonia.ReactiveUI.dll
Avalonia.Skia.dll
Avalonia.Win32.dll
Exodus.deps.json
Exodus.dll
Exodus.exe
Exodus.runtimeconfig.json
MicroCom.Runtime.dll
Microsoft.Win32.Primitives.dll
ReactiveUI.dll
SkiaSharp.dll
Splat.dll
System.Collections.Concurrent.dll
System.Collections.dll
System.ComponentModel.Primitives.dll
System.ComponentModel.TypeConverter.dll
System.ComponentModel.dll
System.Linq.dll
System.Numerics.Vectors.dll
System.ObjectModel.dll
System.Private.CoreLib.dll
System.Private.Uri.dll
System.Reactive.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Runtime.InteropServices.RuntimeInformation.dll
System.Runtime.InteropServices.dll
System.Runtime.dll
System.Threading.Thread.dll
System.Threading.dll
clrjit.dll
config.vbs
coreclr.dll
hostfxr.dll
hostpolicy.dll
is-QY0B2TJKKJ.tmp
netstandard.dll
gfx_sources.rar
is-JUZOH3NCRN.tmp
is-SYDQHJUSNN.tmp
is-YO1LP3MBS2.tmp
__PSScriptPolicyTest_asg2jlly.xxv.ps1
exodus-windows-x64-26.8.27.tmp
memory/4388-879-0x0000000000A40000-0x0000000000B72000-memory.dmp
memory/4388-0-0x0000000000A40000-0x0000000000B72000-memory.dmp
memory/4388-1666-0x0000000000A40000-0x0000000000B72000-memory.dmp
memory/5156-1744-0x0000027BB53A0000-0x0000027BB5453000-memory.dmp
memory/5164-1717-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1719-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1729-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1728-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1727-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1726-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1725-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1724-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1723-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1722-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1721-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5164-1720-0x0000020722740000-0x0000020722B71000-memory.dmp
memory/5836-1683-0x00000240AC1E0000-0x00000240AC1EA000-memory.dmp
memory/5836-1684-0x00000240AC530000-0x00000240AC54C000-memory.dmp
memory/5836-1668-0x00000240ABF50000-0x00000240ABF72000-memory.dmp
memory/5836-1688-0x00000240AC550000-0x00000240AC556000-memory.dmp
memory/5836-1687-0x00000240AC520000-0x00000240AC528000-memory.dmp
memory/5836-1686-0x00000240AC570000-0x00000240AC58A000-memory.dmp
memory/5836-1685-0x00000240AC510000-0x00000240AC51A000-memory.dmp
memory/5836-1689-0x00000240AC560000-0x00000240AC56A000-memory.dmp
memory/5836-1681-0x00000240AC1C0000-0x00000240AC1DC000-memory.dmp
memory/5836-1682-0x00000240AC200000-0x00000240AC2B3000-memory.dmp
memory/5940-5-0x0000000003390000-0x0000000003391000-memory.dmp
memory/5940-890-0x0000000003390000-0x0000000003391000-memory.dmp
memory/5940-881-0x00000000006E0000-0x0000000000B6F000-memory.dmp
memory/5940-1661-0x00000000006E0000-0x0000000000B6F000-memory.dmp
memory/5940-1595-0x00000000006E0000-0x0000000000B6F000-memory.dmp