Behavioral task
behavioral1
Sample
1924-59-0x0000000000400000-0x00000000008D8000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1924-59-0x0000000000400000-0x00000000008D8000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1924-59-0x0000000000400000-0x00000000008D8000-memory.dmp
-
Size
4.8MB
-
MD5
2fdbbca19f25b0694fc2b3bb8eeb8bc5
-
SHA1
0b765411ae4c5eea7ce4094533b5a26f7cffc3ff
-
SHA256
f47ef570c96449cac672000df41b8a078a161fef3e3f3467f6dce3de08b73045
-
SHA512
33a3626517134ebc3b4695a0e48ba952b56831c8d9df9180cb309308af41d6ecc01247356115acb592b1fce4d7dac35e452fec0e3525643f6f31e381bb6173f9
-
SSDEEP
49152:7Z91qDja2VZIHYzNhf8GPmIPrSJ2z/Rab5ER79tGH5RH:RqHVZwGPmaWEpGZRH
Malware Config
Extracted
aurora
94.142.138.18:8081
Signatures
-
Aurora family
Files
-
1924-59-0x0000000000400000-0x00000000008D8000-memory.dmp.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 244KB - Virtual size: 640KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.symtab Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ