expiro | 7fcb57776b43903ab5057303b2dbee8b82bbedbb9c79590e04c6c973bdf49d85

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
04-01-2025 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7a3791f2ac44574cd7068681af0ce383.exe
Size

181KB
MD5

7a3791f2ac44574cd7068681af0ce383
SHA1

9c8cec68967597e78363438a63ab3a5b162a62e4
SHA256

7fcb57776b43903ab5057303b2dbee8b82bbedbb9c79590e04c6c973bdf49d85
SHA512

dbe46fc6c797b70d6fc5cbd8e2f652bfb52c283dabfb985f75d90a12fd31fca6f377edb1c0208a375f875a0365a2c4011f7cb2663276bd11c78ba6d9b9666f34
SSDEEP

3072:J/8kV/MNJtAsyqS0JP9EBztZjdFoxxsvLK3HqGLTUgWayQEJDx2bg9aX8ax5iZ08:Zr/MNJtAsFS0JP9EBRR8xxsvLPGLdyrv

Score

10^/10

expiro backdoor discovery

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/memory/1664-2-0x0000000001000000-0x000000000107A000-memory.dmp	family_expiro1

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7a3791f2ac44574cd7068681af0ce383.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a3791f2ac44574cd7068681af0ce383.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7a3791f2ac44574cd7068681af0ce383.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1664-0-0x0000000001000000-0x000000000107A000-memory.dmp

Filesize
488KB

Download
memory/1664-2-0x0000000001000000-0x000000000107A000-memory.dmp

Filesize
488KB

Download
memory/1664-1-0x0000000001001000-0x0000000001002000-memory.dmp

Filesize
4KB

Download