Analysis
- max time kernel
135s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
31/08/2024, 03:14
General
- Target e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e.exe
- Size 415KB
- Sample240831-drl7yssgrp
- SHA256 e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e
Score
10/10
Malware Config
Signatures
- Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
- Expiro payload 4 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e.exe"C:\Users\Admin\AppData\Local\Temp\e6e731aa7a555d24e130df62cd29c9227b77fc66dccea92ea468bcc5eccf2e4e.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4128,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1988-0-0x0000000000BAB000-0x0000000000C3E000-memory.dmp
memory/1988-1-0x0000000000BAB000-0x0000000000C3E000-memory.dmp
memory/1988-2-0x0000000000B40000-0x0000000000C3E000-memory.dmp
memory/1988-3-0x0000000000B40000-0x0000000000C3E000-memory.dmp