Analysis

  • max time kernel
    115s
  • max time network
    116s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-09-2024 11:33

General

  • Target

    c7501c5118971f1ee4e86372b8963310N.exe

  • Size

    60KB

  • MD5

    c7501c5118971f1ee4e86372b8963310

  • SHA1

    c7a5bf459c452e0d22ca14b7b3e5696f40fb4b48

  • SHA256

    a49043714c414f0680f9ee25dd807f73549ae2385a60604d9bc8b59fe19e4ce6

  • SHA512

    4b26a3ce4bc4b4e931c2f46a7100aaea3cb3514d043add6fb771c4ef625f65f2b5e03e1b6f3b121f308e0a29ea26197aed2be83414c0a1c07c14e771f87653c9

  • SSDEEP

    768:XE30N/7tEaWcArSwaydTb0EroSd3QXGsBS4sZFFSUv6GfEK+RsWW2qTN4lvCy2ZL:gNPeXonnUStQXDI4spvVp+N8NECtH3T

Malware Config

Signatures

  • Expiro, m0yv

    Expiro aka m0yv is a multi-functional backdoor written in C++.

  • Expiro payload 7 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c7501c5118971f1ee4e86372b8963310N.exe
    "C:\Users\Admin\AppData\Local\Temp\c7501c5118971f1ee4e86372b8963310N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4208
    • C:\Users\Admin\AppData\Local\Temp\c7501c5118971f1ee4e86372b8963310N.exe
      "C:\Users\Admin\AppData\Local\Temp\c7501c5118971f1ee4e86372b8963310N.exe"
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Windows\SysWOW64\service187.exe
        -n
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1956
        • C:\Windows\SysWOW64\service187.exe
          -n
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Enumerates connected drives
          • Modifies WinLogon
          • System Location Discovery: System Language Discovery
          PID:4824

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\service187.exe

    Filesize

    60KB

    MD5

    c7501c5118971f1ee4e86372b8963310

    SHA1

    c7a5bf459c452e0d22ca14b7b3e5696f40fb4b48

    SHA256

    a49043714c414f0680f9ee25dd807f73549ae2385a60604d9bc8b59fe19e4ce6

    SHA512

    4b26a3ce4bc4b4e931c2f46a7100aaea3cb3514d043add6fb771c4ef625f65f2b5e03e1b6f3b121f308e0a29ea26197aed2be83414c0a1c07c14e771f87653c9

  • memory/1036-9-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1036-4-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1036-5-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1036-1-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1956-17-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/4208-3-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/4208-0-0x0000000000400000-0x0000000000417000-memory.dmp

    Filesize

    92KB

  • memory/4824-18-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4824-19-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4824-20-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4824-22-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4824-28-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/4824-29-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB