Analysis

  • max time kernel
    94s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2024 19:41

General

  • Target

    a225275b37dc396bd2619a87ff2b16ebb2d82ca201d8fa2f446696fcf453403e.exe

  • Size

    7.3MB

  • MD5

    a6b8db8215b183a84d56e2c0e76147fa

  • SHA1

    e6dcc80893afdc173ebaba8061543d0986e7ad80

  • SHA256

    a225275b37dc396bd2619a87ff2b16ebb2d82ca201d8fa2f446696fcf453403e

  • SHA512

    e4ff9c34769468a08088cfabb1941928727f17d8de6f7f96b9d20b7b5d90a32fe8d4308b8b3cb5f2d8cde7d4c2942ce1dd32527a9ec6008f33906e587f9d9bba

  • SSDEEP

    98304:3xC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF00X:8GQgMkhgJuP32+dmhZk/0k

Malware Config

Signatures

  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

  • Expiro payload 4 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a225275b37dc396bd2619a87ff2b16ebb2d82ca201d8fa2f446696fcf453403e.exe
    "C:\Users\Admin\AppData\Local\Temp\a225275b37dc396bd2619a87ff2b16ebb2d82ca201d8fa2f446696fcf453403e.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 428
      2⤵
      • Program crash
      PID:3588
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2368 -ip 2368
    1⤵
      PID:2500

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2368-0-0x000000000099E000-0x0000000000A31000-memory.dmp

      Filesize

      588KB

    • memory/2368-1-0x0000000000250000-0x0000000000A31000-memory.dmp

      Filesize

      7.9MB

    • memory/2368-2-0x000000000099E000-0x0000000000A31000-memory.dmp

      Filesize

      588KB

    • memory/2368-3-0x0000000000250000-0x0000000000A31000-memory.dmp

      Filesize

      7.9MB