expiro | 2f38fd9d588ccb97001ffb4809c48027ac7b257f874601ba1fd8b4c3759461c8

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/01/2025, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_678d2c6facc2e53eb078177a63ca6330.exe
Size

543KB
MD5

678d2c6facc2e53eb078177a63ca6330
SHA1

f98aa52218e939f3a100be8b11194e0cf0ea30f2
SHA256

2f38fd9d588ccb97001ffb4809c48027ac7b257f874601ba1fd8b4c3759461c8
SHA512

7cbfc8de6b154784fceadb2af86c444465b93eedbec1fff45d3025b8184143f7fd2a837f08bae6c392a47d04fc62ad8c3af0a07eb5998ec289a9f525a157c761
SSDEEP

12288:KcO0USXCGocHsxZbGka7cf2yl2Wy3XlrUbYWq46:ZO0USXCGT0poAf2yl2Wy3XCbY

Score

10^/10

expiro backdoor discovery

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/memory/2512-2-0x0000000001000000-0x00000000011B4000-memory.dmp	family_expiro1

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_678d2c6facc2e53eb078177a63ca6330.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_678d2c6facc2e53eb078177a63ca6330.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_678d2c6facc2e53eb078177a63ca6330.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-0-0x0000000001000000-0x00000000011B4000-memory.dmp

Filesize
1.7MB

Download
memory/2512-1-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download
memory/2512-2-0x0000000001000000-0x00000000011B4000-memory.dmp

Filesize
1.7MB

Download