Overview
overview
8Static
static
3Exodus-Lar...us.exe
windows10-2004-x64
8Exodus-Lar...us.exe
windows11-ltsc_2024-x64
8Exodus-Lar...rp.dll
windows10-2004-x64
1Exodus-Lar...rp.dll
windows11-ltsc_2024-x64
1Exodus-Lar...me.dll
windows10-2004-x64
1Exodus-Lar...me.dll
windows11-ltsc_2024-x64
1Exodus-Lar...ng.dll
windows10-2004-x64
1Exodus-Lar...ng.dll
windows11-ltsc_2024-x64
1Exodus-Lar...ng.dll
windows10-2004-x64
1Exodus-Lar...ng.dll
windows11-ltsc_2024-x64
1Exodus-Lar...on.dll
windows10-2004-x64
1Exodus-Lar...on.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/11/2026, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
Exodus-Larp-Tool-main/Exodus.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Exodus-Larp-Tool-main/Exodus.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Exodus-Larp-Tool-main/HarfBuzzSharp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Exodus-Larp-Tool-main/HarfBuzzSharp.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Exodus-Larp-Tool-main/MicroCom.Runtime.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Exodus-Larp-Tool-main/MicroCom.Runtime.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.CSharp.Scripting.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.CSharp.Scripting.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.Scripting.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Exodus-Larp-Tool-main/Microsoft.CodeAnalysis.Scripting.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Exodus-Larp-Tool-main/Newtonsoft.Json.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Exodus-Larp-Tool-main/Newtonsoft.Json.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Exodus-Larp-Tool-main/Exodus.exe
- Size 399KB
- Sample261102-esae8aea73
- SHA256 6c977cac10245be0d1222fa444aafeed327e840a8864c7a37feb401ed51e7257
- MD5 ba5da443c5e881df3147e9c110240df3
- SHA1 4841a82719a2ef2092752ccf107dcc021a59134c
- SHA512 86d167aaa77b2ecf0b624e8c37b48073b98126aa05e9af949e362b5025f8a81210082810c169ea9a9a2987c3e8052e1110dd2a5f6b7c54e67161338e013e9c94
- SSDEEP 3072:VBRO3hCKpIdtHO1qeGAhY5dqkBfyboS0lYi5iNMfYT:nReIdtuE5dqkBfyboo
- TLSH T14A9495273FB9DE48C21CBD7A69F18737B7318A250D4A05117E122E73D672DA8FB81684
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 16 1872 background.exe 15 1524 Loader.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation Exodus.exe Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation Loader.exe Key value queried \REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation background.exe - Executes dropped EXE 3 IoCs
pid Process 1524 Loader.exe 1872 background.exe 1796 W52UE52XBY31.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 11 pastebin.com 12 pastebin.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Loader.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain background.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname background.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Exodus.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1524 Loader.exe 1872 background.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1524 Loader.exe Token: SeDebugPrivilege 1872 background.exe Token: SeIncreaseQuotaPrivilege 1524 Loader.exe Token: SeSecurityPrivilege 1524 Loader.exe Token: SeTakeOwnershipPrivilege 1524 Loader.exe Token: SeLoadDriverPrivilege 1524 Loader.exe Token: SeSystemProfilePrivilege 1524 Loader.exe Token: SeSystemtimePrivilege 1524 Loader.exe Token: SeProfSingleProcessPrivilege 1524 Loader.exe Token: SeIncBasePriorityPrivilege 1524 Loader.exe Token: SeCreatePagefilePrivilege 1524 Loader.exe Token: SeBackupPrivilege 1524 Loader.exe Token: SeRestorePrivilege 1524 Loader.exe Token: SeShutdownPrivilege 1524 Loader.exe Token: SeDebugPrivilege 1524 Loader.exe Token: SeSystemEnvironmentPrivilege 1524 Loader.exe Token: SeRemoteShutdownPrivilege 1524 Loader.exe Token: SeUndockPrivilege 1524 Loader.exe Token: SeManageVolumePrivilege 1524 Loader.exe Token: 33 1524 Loader.exe Token: 34 1524 Loader.exe Token: 35 1524 Loader.exe Token: 36 1524 Loader.exe Token: SeIncreaseQuotaPrivilege 1524 Loader.exe Token: SeSecurityPrivilege 1524 Loader.exe Token: SeTakeOwnershipPrivilege 1524 Loader.exe Token: SeLoadDriverPrivilege 1524 Loader.exe Token: SeSystemProfilePrivilege 1524 Loader.exe Token: SeSystemtimePrivilege 1524 Loader.exe Token: SeProfSingleProcessPrivilege 1524 Loader.exe Token: SeIncBasePriorityPrivilege 1524 Loader.exe Token: SeCreatePagefilePrivilege 1524 Loader.exe Token: SeBackupPrivilege 1524 Loader.exe Token: SeRestorePrivilege 1524 Loader.exe Token: SeShutdownPrivilege 1524 Loader.exe Token: SeDebugPrivilege 1524 Loader.exe Token: SeSystemEnvironmentPrivilege 1524 Loader.exe Token: SeRemoteShutdownPrivilege 1524 Loader.exe Token: SeUndockPrivilege 1524 Loader.exe Token: SeManageVolumePrivilege 1524 Loader.exe Token: 33 1524 Loader.exe Token: 34 1524 Loader.exe Token: 35 1524 Loader.exe Token: 36 1524 Loader.exe Token: SeIncreaseQuotaPrivilege 1524 Loader.exe Token: SeSecurityPrivilege 1524 Loader.exe Token: SeTakeOwnershipPrivilege 1524 Loader.exe Token: SeLoadDriverPrivilege 1524 Loader.exe Token: SeSystemProfilePrivilege 1524 Loader.exe Token: SeSystemtimePrivilege 1524 Loader.exe Token: SeProfSingleProcessPrivilege 1524 Loader.exe Token: SeIncBasePriorityPrivilege 1524 Loader.exe Token: SeCreatePagefilePrivilege 1524 Loader.exe Token: SeBackupPrivilege 1524 Loader.exe Token: SeRestorePrivilege 1524 Loader.exe Token: SeShutdownPrivilege 1524 Loader.exe Token: SeDebugPrivilege 1524 Loader.exe Token: SeSystemEnvironmentPrivilege 1524 Loader.exe Token: SeRemoteShutdownPrivilege 1524 Loader.exe Token: SeUndockPrivilege 1524 Loader.exe Token: SeManageVolumePrivilege 1524 Loader.exe Token: 33 1524 Loader.exe Token: 34 1524 Loader.exe Token: 35 1524 Loader.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3120 wrote to memory of 1524 3120 Exodus.exe 86 PID 1524 wrote to memory of 1872 1524 Loader.exe 89 PID 1872 wrote to memory of 1796 1872 background.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exodus-Larp-Tool-main\Exodus.exe"C:\Users\Admin\AppData\Local\Temp\Exodus-Larp-Tool-main\Exodus.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Loader.exe"2⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\a9252811-86f1-44f3-90f0-b8c7a1a055be\background.exe"C:\Users\Admin\AppData\Local\a9252811-86f1-44f3-90f0-b8c7a1a055be\background.exe"3⤵
- Downloads MZ/PE file
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Users\Admin\AppData\Local\1213db70-9798-4bf3-a80a-60354d2a76b7\W52UE52XBY31.exe"C:\Users\Admin\AppData\Local\1213db70-9798-4bf3-a80a-60354d2a76b7\W52UE52XBY31.exe"4⤵
- Executes dropped EXE
PID:1796
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\1213db70-9798-4bf3-a80a-60354d2a76b7\W52UE52XBY31.exe
- Size 2.0MB
- SHA256 8daf63d256788702648f1699d1909d7a862bb9859ca93bbf96fd73f70bc107a9
- MD5 8b8437eab9e8d2db15976fd895a07d7c
- SHA1 46d76968389c0fb8482cfde6603c2dcdbae85634
- SHA512 e9a09bcaabf70809ca43a81d6d163bc7fde04fe8b1e3beb5f798f2a0e5ce67fe97b19d7f9bf043c4b3a42b7b49afdc61239a4fc008478df9259a2af96293c62f
- SSDEEP 49152:8JShofikO5GAmXawUl8qM5+/keT0U9oKr0G0eDD/:8JShVkahmXaN875+voU9XO2D/
- TLSH T13FA52362731428F1FC86C87882559636BB3B70972FA555FB63A511A12F34FE01F78A23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Loader.exe
- Size 36KB
- SHA256 9df11356c5ac61d2aa7b5425e6322fc016b0ed5790dacb201396500b3eee03f7
- MD5 64eb7ad3aaf9b6639ccc5c0b30b6e59f
- SHA1 1eb377e01e1e649b3290efb0160f25cb5d13bd21
- SHA512 a6c32d40bc2a053c53f5db04e45a960695b33422cec59a58cd526cccfa8ceadbb1926ffdc8cb429f748cb2286b2bb33af3577e07e8ecd7f01901c22055634cb0
- SSDEEP 768:dmQZqx1lYcTYbFyf8qsIVeljnbaoXbYC10kof:d0lYisIVeljRbPof
- TLSH T1D7F23B49BB58C12ADBAF0E7D75621A50167197521203CFD53ECC65EEFF937008612B8B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e4p1wz1l.n2m.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\a9252811-86f1-44f3-90f0-b8c7a1a055be\background.exe
- Size 35KB
- SHA256 3d329e1e9a067ab023c0da0880fdbc25a7c696bff73004ce0cac5da36cd1df7a
- MD5 70fa29433f473f7f0482cfaa6b091120
- SHA1 53a69a2441df933edb561a975da1ec055f4d25cf
- SHA512 b0b26d02ae66a5207ced050a98569522ca8c047d4bdb8bbcb8238d52bb4b6b02344a16bd2e2b18e29983d2ba22deea074b3ea72048387aeeb89b30497ab5cd42
- SSDEEP 768:cmQZqx1lYcTYbFyf8qIIRF8jnbaoXbYC10kov:c0lYiIIRF8jRbPov
- TLSH T1CDF23A497B98C12BDBAF0E7D65621A10167297521203CBD53ECC64EEFFA37058612B8B
- MD5 SHA1 SHA512 SSDEEP TLSH