expiro | 9df46c82087da02199afe2a028ae3c643f0c08ad5fd3fef45b4e8207be9d14e8

Analysis

max time kernel
14s
max time network
18s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9df46c82087da02199afe2a028ae3c643f0c08ad5fd3fef45b4e8207be9d14e8.exe
Size

779KB
MD5

0e70c3c463161416241eb3cd3f63bb46
SHA1

3be542edb76638ee10c790b67eb6c5c01a7bc111
SHA256

9df46c82087da02199afe2a028ae3c643f0c08ad5fd3fef45b4e8207be9d14e8
SHA512

af91abe69055a452b0cf111179e5cccc3050b50471f550b130ac52557158d3a3d2bea7ec97b79a543e61435c966e0aac387d1e2649a8ff5fc99cc51646e16dda
SSDEEP

12288:8xLVssCpn5K6hzkolQBW3K88Uf3vYPNZ7QNvrNgPkmTFIqcx46lQnfd:8xLQi6hDQBnO3YPNZ7wMGQf

Score

10^/10

expiro backdoor discovery

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2220-2-0x0000000001000000-0x00000000011E6000-memory.dmp	family_expiro1

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9df46c82087da02199afe2a028ae3c643f0c08ad5fd3fef45b4e8207be9d14e8.exe

C:\Users\Admin\AppData\Local\Temp\9df46c82087da02199afe2a028ae3c643f0c08ad5fd3fef45b4e8207be9d14e8.exe
"C:\Users\Admin\AppData\Local\Temp\9df46c82087da02199afe2a028ae3c643f0c08ad5fd3fef45b4e8207be9d14e8.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-0-0x0000000001000000-0x00000000011E6000-memory.dmp

Filesize
1.9MB

Download
memory/2220-2-0x0000000001000000-0x00000000011E6000-memory.dmp

Filesize
1.9MB

Download
memory/2220-1-0x000000000102E000-0x000000000102F000-memory.dmp

Filesize
4KB

Download