Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    31-08-2024 06:07

General

  • Target

    a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe

  • Size

    406KB

  • MD5

    c8a46327ca3a8a0a5db01c32ba508f20

  • SHA1

    0e737ae39d373dda72816d12737163ca068a7716

  • SHA256

    a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625

  • SHA512

    468b8b3a828a43e073af6d4c02eb356e608262b1496044e94d0d161eb1976f6d03f6fc23254086e74673a4ffea5ab9054813feb8c5ab0e18e3c5a93cef55e980

  • SSDEEP

    6144:KIzfx0tsmxGjd9suGjWIDhAJSbnVrw8/LppZ2oqIqOEhspJ:1fqOwGTlW9N0Qrw62obqap

Score
10/10

Malware Config

Signatures

  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

  • Expiro payload 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe
    "C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe"
    1⤵
      PID:2172

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2172-0-0x000000000041A000-0x00000000004AD000-memory.dmp

      Filesize

      588KB

    • memory/2172-1-0x00000000003B0000-0x00000000004AD000-memory.dmp

      Filesize

      1012KB

    • memory/2172-2-0x000000000041A000-0x00000000004AD000-memory.dmp

      Filesize

      588KB