expiro | 411b208b31f28b5feb2a560f2966ca93f6000949b9f78325baf2f16261989cfb

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/04/2024, 21:43

Target

e87bd5de0d9542afa5f0c850913e397f_JaffaCakes118.exe
Size

692KB
MD5

e87bd5de0d9542afa5f0c850913e397f
SHA1

dc783112ce98460660267a87111302745662fa67
SHA256

411b208b31f28b5feb2a560f2966ca93f6000949b9f78325baf2f16261989cfb
SHA512

5567dafc833d603eb3cde4b5bd22f62d1ab3590a7d7d89bc5adecbe4cfd4877a45cfc7b610cb51b62bb011c10a47df320e51a3d68f4275b9c9232a73023a7009
SSDEEP

6144:U9kbpoDtM1nM91o/CwxTmqNbGU3ffiP51Ca3uuHGEmY+iurSP0dq8VQy1+zromwH:Vo6S8/CwJYUvWzuuy7iuWYr6oBD92iD

Score

10^/10

expiro backdoor

Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 4 IoCs

backdoor

resource	yara_rule
behavioral1/memory/3036-0-0x000000004A190000-0x000000004A2D3000-memory.dmp	family_expiro1
behavioral1/memory/3036-3-0x000000004A190000-0x000000004A2D3000-memory.dmp	family_expiro1
behavioral1/memory/3036-1-0x000000004A190000-0x000000004A2D3000-memory.dmp	family_expiro1
behavioral1/memory/3036-4-0x000000004A190000-0x000000004A2D3000-memory.dmp	family_expiro1

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	3036	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 3000	3036	e87bd5de0d9542afa5f0c850913e397f_JaffaCakes118.exe	29
PID 3036 wrote to memory of 3000	3036	e87bd5de0d9542afa5f0c850913e397f_JaffaCakes118.exe	29
PID 3036 wrote to memory of 3000	3036	e87bd5de0d9542afa5f0c850913e397f_JaffaCakes118.exe	29
PID 3036 wrote to memory of 3000	3036	e87bd5de0d9542afa5f0c850913e397f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\e87bd5de0d9542afa5f0c850913e397f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e87bd5de0d9542afa5f0c850913e397f_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 156
  2⤵
  - Program crash
  PID:3000

memory/3036-0-0x000000004A190000-0x000000004A2D3000-memory.dmp

Filesize
1.3MB

Download
memory/3036-3-0x000000004A190000-0x000000004A2D3000-memory.dmp

Filesize
1.3MB

Download
memory/3036-1-0x000000004A190000-0x000000004A2D3000-memory.dmp

Filesize
1.3MB

Download
memory/3036-4-0x000000004A190000-0x000000004A2D3000-memory.dmp

Filesize
1.3MB

Download