expiro | 4458bf4125bfc990db039e6b488ea69817af9c4627c1af8d7b40d0182bba7da8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 03:56

Target

ca29ba90f0ba302e70dcc107cec7cc26_JaffaCakes118.exe
Size

7.3MB
MD5

ca29ba90f0ba302e70dcc107cec7cc26
SHA1

f0ba3ffdfaaa741ea197989ca0ab9390fde78f92
SHA256

4458bf4125bfc990db039e6b488ea69817af9c4627c1af8d7b40d0182bba7da8
SHA512

ff177e970837c30e62a9d897b9b5a9d464cc397be2d62b010d7afbba087159d0ef3d7bf50c14812cfd91f847b2f5961019f4e428a59a4fc705bf92c45756b38a
SSDEEP

98304:hxC3ud6MOIvysiwCQKzo5qphIHVruP3WpF3UdE1hZHEdLFCmil+:WGQFMkhgJuP32+dmhZk/g

Score

10^/10

expiro backdoor

Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral1/memory/3068-0-0x0000000001110000-0x00000000018F1000-memory.dmp	family_expiro1
behavioral1/memory/3068-1-0x0000000001110000-0x00000000018F1000-memory.dmp	family_expiro1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2100	3068	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2100	3068	ca29ba90f0ba302e70dcc107cec7cc26_JaffaCakes118.exe	28
PID 3068 wrote to memory of 2100	3068	ca29ba90f0ba302e70dcc107cec7cc26_JaffaCakes118.exe	28
PID 3068 wrote to memory of 2100	3068	ca29ba90f0ba302e70dcc107cec7cc26_JaffaCakes118.exe	28
PID 3068 wrote to memory of 2100	3068	ca29ba90f0ba302e70dcc107cec7cc26_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\ca29ba90f0ba302e70dcc107cec7cc26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ca29ba90f0ba302e70dcc107cec7cc26_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 156
  2⤵
  - Program crash
  PID:2100

memory/3068-0-0x0000000001110000-0x00000000018F1000-memory.dmp

Filesize
7.9MB

Download
memory/3068-1-0x0000000001110000-0x00000000018F1000-memory.dmp

Filesize
7.9MB

Download