expiro | 0e6a3aacae83b3a37fab25060d67f6fc82326ef7862e1041e3b677d1ea949e14

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-01-2025 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_77b9f6ea0ef22179d65a126ea80dd270.exe
Size

583KB
MD5

77b9f6ea0ef22179d65a126ea80dd270
SHA1

986fb4f1c9fd47daee5d48872ac3ea310b9e59e9
SHA256

0e6a3aacae83b3a37fab25060d67f6fc82326ef7862e1041e3b677d1ea949e14
SHA512

2821043173f509082a127a24b2255c14cd5753d632778ba708731c51dc8a1ae855159c010e4cf76998ce1f1e44c25c26222b4965e36a8536543613970e0eaea3
SSDEEP

12288:Mul/phrRiblNyB3KVRmQfMGp3Zz2erDHVPWx3k/Q/As78KDb9E2Ox19GycBskv7m:3lBhrRibfyB3KVRmEMGp3Zz2e3HV7/QU

Score

10^/10

expiro backdoor discovery

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 2 IoCs

backdoor

resource	yara_rule
behavioral2/memory/1608-2-0x0000000001000000-0x00000000011AD000-memory.dmp	family_expiro1
behavioral2/memory/1608-3-0x0000000001000000-0x00000000011AD000-memory.dmp	family_expiro1

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3112	1608	WerFault.exe	82
1792	1608	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_77b9f6ea0ef22179d65a126ea80dd270.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77b9f6ea0ef22179d65a126ea80dd270.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77b9f6ea0ef22179d65a126ea80dd270.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 908
  2⤵
  - Program crash
  PID:3112
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 928
  2⤵
  - Program crash
  PID:1792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1608 -ip 1608
1⤵
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1608 -ip 1608
1⤵
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1608-0-0x0000000001000000-0x00000000011AD000-memory.dmp

Filesize
1.7MB

Download
memory/1608-1-0x0000000001005000-0x0000000001006000-memory.dmp

Filesize
4KB

Download
memory/1608-2-0x0000000001000000-0x00000000011AD000-memory.dmp

Filesize
1.7MB

Download
memory/1608-3-0x0000000001000000-0x00000000011AD000-memory.dmp

Filesize
1.7MB

Download