Analysis

  • max time kernel
    132s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-08-2024 05:59

General

  • Target

    7736e2923f0969b84166b05537aed354ad3f8a3e571af505daa9003838354d7b.exe

  • Size

    1.2MB

  • MD5

    c5b67871b12b397585cad3482b8b1d14

  • SHA1

    8e1ef341018d9f1581a592514427a051f850fc30

  • SHA256

    7736e2923f0969b84166b05537aed354ad3f8a3e571af505daa9003838354d7b

  • SHA512

    5f286133e974954ea1014ad6365424847a61f5da2f83771ce713daac6b72ea669cf1b3aa3ab9775928694d07a3e4561d916fa2be5edb439160a607c268902d18

  • SSDEEP

    24576:cNQ+9+MzVdi/JZgQzYM65mpXNgbUDGTgl1Y9IrQig38jNayXJUtt:I9HhQBuM65mp9DG0l1Y9IrQBMjXJ

Malware Config

Signatures

  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

  • Expiro payload 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\7736e2923f0969b84166b05537aed354ad3f8a3e571af505daa9003838354d7b.exe
    "C:\Users\Admin\AppData\Local\Temp\7736e2923f0969b84166b05537aed354ad3f8a3e571af505daa9003838354d7b.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1920

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1920-0-0x000000000053A000-0x00000000005CE000-memory.dmp

    Filesize

    592KB

  • memory/1920-1-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB

  • memory/1920-2-0x000000000053A000-0x00000000005CE000-memory.dmp

    Filesize

    592KB

  • memory/1920-3-0x0000000000400000-0x00000000005CE000-memory.dmp

    Filesize

    1.8MB