Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 03:14

General

  • Target

    a6a56dd2a6064870c1df65078f56173b9dd620f770dadc909fa8da4062e6160a.exe

  • Size

    457KB

  • MD5

    76a693274bee28762547daae64483104

  • SHA1

    e76138e11a3bb616ab084f3517335250c573f861

  • SHA256

    a6a56dd2a6064870c1df65078f56173b9dd620f770dadc909fa8da4062e6160a

  • SHA512

    407c597e1beed5ce2c2a23998610cdb755345bc586fc5d738b4fb59f551955c52af7dcd3eac18a794a64ccaff5d1d7c401d6270bf9daec30194df9ee91bb6291

  • SSDEEP

    12288:i3txYm5THviE5X+Tvknp8WYe4YTjU/OP03cdiJ:mP1TH95X0Y8m/4WP0Q

Malware Config

Signatures

  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

  • Expiro payload 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6a56dd2a6064870c1df65078f56173b9dd620f770dadc909fa8da4062e6160a.exe
    "C:\Users\Admin\AppData\Local\Temp\a6a56dd2a6064870c1df65078f56173b9dd620f770dadc909fa8da4062e6160a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4080-0-0x0000000010074000-0x0000000010108000-memory.dmp

    Filesize

    592KB

  • memory/4080-1-0x0000000010000000-0x0000000010108000-memory.dmp

    Filesize

    1.0MB

  • memory/4080-2-0x0000000010074000-0x0000000010108000-memory.dmp

    Filesize

    592KB

  • memory/4080-3-0x0000000010000000-0x0000000010108000-memory.dmp

    Filesize

    1.0MB