expiro | 7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223d

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 01:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
Size

635KB
MD5

79fe1ca4d124971e6b872d5d6acd25f0
SHA1

eca06b23d460392695fbea380a6e4ed69ea14d55
SHA256

7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223d
SHA512

7e37f5cff2d86b325d3acb44b1a6821c94a221a70fa9ac81369fd8b22aeea3df5e6e652ba46618f7b06393045b09e7d8c7c676334c14666f27b9c1a0cf2dcf61
SSDEEP

12288:WDB+kxedc++Zvwx4jZVvPr+WmCqeDkqZ7K0Y7hbM:WDB+kxeqPZvwujZVn8eDhXYNb

Score

10^/10

expiro backdoor credential_access discovery spyware stealer

Malware Config

Signatures

Expiro family
expiro
Expiro, m0yv
Expiro aka m0yv is a multi-functional backdoor written in C++.
backdoor expiro

Expiro payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/memory/728-2-0x0000000001000000-0x00000000011BA000-memory.dmp	family_expiro1

Executes dropped EXE 7 IoCs

pid	Process
2532	elevation_service.exe
2588	elevation_service.exe
4732	maintenanceservice.exe
2364	OSE.EXE
1276	ssh-agent.exe
2180	AgentService.exe
696	wbengine.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlddmedljhmbgdhapibnagaanenmajcm\1.0_0\manifest.json	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\K:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\S:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\G:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\H:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\T:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\W:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\J:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\M:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\N:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\O:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\P:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\R:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\U:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\V:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\X:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\Y:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\Z:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\E:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\L:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened (read-only)	\??\Q:	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe

Drops file in System32 directory 61 IoCs

description	ioc	Process
File created	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\sensordataservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\Agentservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\vds.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\wbem\wmiApsrv.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\perfhost.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\locator.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\snmptrap.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\openssh\ssh-agent.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\Appvclient.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\sensordataservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\lsass.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\msiexec.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\tieringengineservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\Agentservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\locator.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\vssvc.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\wbengine.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\wbem\wmiApsrv.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\msdtc.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\msiexec.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\spectrum.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\wbengine.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\alg.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\alg.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\fxssvc.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\wbengine.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\msdtc.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\sgrmbroker.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\sgrmbroker.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\Agentservice.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\dllhost.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\fxssvc.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\vssvc.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\searchindexer.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\Appvclient.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\msdtc.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\searchindexer.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\msiexec.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\snmptrap.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\tieringengineservice.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\vds.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\fxssvc.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\snmptrap.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\svchost.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\system32\spectrum.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\openssh\ssh-agent.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\openssh\ssh-agent.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\svchost.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\system32\Appvclient.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\windows\SysWOW64\msiexec.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\program files\windows media player\wmpnetwk.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Internet Explorer\iexplore.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javapackager.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jdeps.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\TabTip.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\dotnet\dotnet.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\7-Zip\7zG.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javap.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	\??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Internet Explorer\ielowutil.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\serialver.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jabswitch.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.vir	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
File opened for modification	\??\c:\windows\servicing\trustedinstaller.exe	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	728	7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe

C:\Users\Admin\AppData\Local\Temp\7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe
"C:\Users\Admin\AppData\Local\Temp\7971ad20e117b347787bb55470bde1cfa814d6479c1ccc5767e2c935b507223dN.exe"
1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:728

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2588

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:4732

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2364

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1276

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
PID:696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

Filesize
2.1MB

MD5
728d84fff68da35a042eeafd1a1a6f8d

SHA1
99c023c9ad7e08b4f1582b2c7155507c5145eedf

SHA256
29cb1d54bdd145d412c4135dc3ea82e4e71c740c5acf87935c6a439d66e4665c

SHA512
1f446113fc79123656577e5ebea617f5c522432bb77f5ba2b6d016f0869ca2cb65273525d4c23ceef2ffa4aee1efe61abe35b4639ded67b8fb2da2c68e92d127

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
731KB

MD5
2766363e84ea8a7b1d598ba44f2fe9b1

SHA1
f99b8159e9bee349a555919e512734df62841256

SHA256
265f68a15efb653731a93129e55de8d33a421fb6c0d50900e6eef7cb7f51888e

SHA512
ae1e415ae31632c30908b2a300a378838b102a7b4d48c8313f698ea487b88358599aed35453a522252be581b8db550928e0ba6e2605f4eab98ca26178ad3c64a

Download Submit
C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
748KB

MD5
baef7b59514fda9c4d72af455e243e6b

SHA1
f2ccc7355d690bf5ebb2109faa18eb8ee1ff18df

SHA256
e406b3c8e270639bbf232166b3e7fe4db11cbca8d42ac32746d42896dd1ff448

SHA512
4dc9b4abf3d3aa56d28447cab6582b578c0832c4c3e46149f22df4152b1c83e819c87213a4b0f35d2bdb61c46e19ee531118f241553e9576c6729d6538b7ae8f

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.vir

Filesize
4.5MB

MD5
7e70e99c739df8174e30bebc0ec9926f

SHA1
e45a690347250bf57b1b1fb0a906cc5019214050

SHA256
60a6e56c1bd87ea3c0eb5c05cbea2bacb16d76d64137dcec30643a3e9d11109b

SHA512
0daa82e380051550798dd6fe04f3a627a1f4029a2333fe14b4bc36a6ec8585bd1d03db1ae40b2e3ad856fe0ed6f8970c8927ea03de3dcadef38fd27b17a9eed7

Download Submit
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

Filesize
2.1MB

MD5
0d88a4d009736f57deeb1e3adb15f4ea

SHA1
751375995d11e823fab0faddd9234544487786ac

SHA256
dc48e8c461be6b2d8eb6e9a6609ca712eeb9b28dd47aeecd2ccb8b3f4775e3df

SHA512
70f920d69bdb12bcc2980a568fd959e02231e6d0fc0931b82f858fed9d424a5ba36d543286090c3d5f627ab4728ab236774e96eb5b4c3ff915c0d7dfe6630814

Download Submit
C:\Program Files\Internet Explorer\iexplore.exe

Filesize
1.3MB

MD5
8dcf62d975d0fd92d9ddb50dee8afacc

SHA1
b09e10ceadb51eb61ba39b6db96fb4fa5b973d2f

SHA256
dd0213a6043ee5dd362c08515eea4152714dc45edc498d3313a9a07841ec4c7c

SHA512
800481fd63ab40a205a5c32bd17af6712647ab09c210afdd4d4521d46cb9b71bda9fd37545ef168550b8a3881fa78c19ccef10ba370df095af73d42c1053c2fa

Download Submit
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Filesize
931KB

MD5
fbd875ad468e8cb2ac2459a4be9eab45

SHA1
2d4e6ddbeb1006dc17630abe1a5563e27e78e828

SHA256
5eccaadb12b3438dd681afefb72a30c1253e93b3f8345cd12bc159600c9b8355

SHA512
aad9248f69d21ab1a859daf020a168e6819a9e4076c1bfc83919cf08c890f733d1468495ad6db03d8aa0a4cf0ca8225dbe1129c0308a73e1a5afee30b79376ea

Download Submit
C:\Windows\System32\AgentService.exe

Filesize
1.7MB

MD5
93ad44333f94fac28d68e1d372ff2baa

SHA1
49a64e17414158ba8b1bb7357e7824ba5022a36d

SHA256
917fb117cc36aa39267ec8aa6f301b39e963335268ecda74f856b6feb9648b89

SHA512
071cccd2ea61d2ac66c8bf104a8fe91b7f2fc4ba0b2cd8dd85be5bd0352c85a1b3a0b2cd7481567d30a5ccde009a5726c68434127f34c0acd8e2b7442331011a

Download Submit
C:\Windows\System32\Appvclient.vir

Filesize
1.2MB

MD5
c95d533fb581868667b182f5f9b9c917

SHA1
c4bf0582f4e47590c948f9de4746768f41448a99

SHA256
4174521f3d92155435769aaabb3f9b29f383a547f9b332933f1ef86ccb4065b5

SHA512
2defc59f004d1844581ee5bc4ec0781d496be351dbba28fbe48ebb2a10b990036b35bf127f92c3670d35b7b87489c304ba57669db6abe2d73ff1db40e95e0a07

Download Submit
C:\Windows\System32\OpenSSH\ssh-agent.exe

Filesize
882KB

MD5
7b950c387a12cf77207c9fdb9f42a4f0

SHA1
78b8e1bb3a93cd2148eb5cbbc4b49d485e31b8eb

SHA256
e3650a6e7ba3349ad5e755bde1ee24452e27ed1bbe51e2ad1f0c8cc14e691394

SHA512
061c7f9ff969576dc345558f247ebd754bb71b9809e4c6263816f6e0c7d678f400fc99ed4a50a7ff97d93e1e26477650f4f1262aef664e610f6a6aa5892b3268

Download Submit
C:\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
673c6b7182dc5de6cad7e283aa330f56

SHA1
af55b4a1913e51d7816e889be8dbb5646780afed

SHA256
1ddc7c4bb93f7a813d877e338c0f8beca7c46e9049b532add3d14431312fabff

SHA512
94561a94bb9b40d755014ed9ab30aa248d5d12490a54966983b916860c8801c909f5c155cd5228f8068a1cc3cfd908809cde2d73a92390a4b30d5e0a2c0733de

Download Submit
memory/696-90-0x0000000140000000-0x000000014034A000-memory.dmp

Filesize
3.3MB

Download
memory/696-89-0x0000000140000000-0x000000014034A000-memory.dmp

Filesize
3.3MB

Download
memory/728-2-0x0000000001000000-0x00000000011BA000-memory.dmp

Filesize
1.7MB

Download
memory/728-1-0x0000000001008000-0x0000000001009000-memory.dmp

Filesize
4KB

Download
memory/728-0-0x0000000001000000-0x00000000011BA000-memory.dmp

Filesize
1.7MB

Download
memory/1276-74-0x0000000140000000-0x0000000140236000-memory.dmp

Filesize
2.2MB

Download
memory/1276-72-0x0000000140000000-0x0000000140236000-memory.dmp

Filesize
2.2MB

Download
memory/2180-82-0x0000000140000000-0x00000001402F4000-memory.dmp

Filesize
3.0MB

Download
memory/2180-81-0x0000000140000000-0x00000001402F4000-memory.dmp

Filesize
3.0MB

Download
memory/2364-60-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download
memory/2364-59-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download
memory/2532-21-0x0000000140000000-0x0000000140368000-memory.dmp

Filesize
3.4MB

Download
memory/2532-20-0x0000000140000000-0x0000000140368000-memory.dmp

Filesize
3.4MB

Download
memory/2588-29-0x0000000140000000-0x000000014035F000-memory.dmp

Filesize
3.4MB

Download
memory/2588-28-0x0000000140000000-0x000000014035F000-memory.dmp

Filesize
3.4MB

Download
memory/4732-37-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download
memory/4732-36-0x0000000140000000-0x0000000140203000-memory.dmp

Filesize
2.0MB

Download