|�B��vyf�:�7��6\G�52����v�V⥽ ���P*3�u�_F��I�4ṩm(�Kq�#>ä"�����ث�@��Rfac~� �y5�l��DR�Qc��{C.����rΆ�L��^ˉ�s�3c���98�Ә ��������[�VT���+�,d ����ṛ�?�d@_|��;M��fZ�r4� �0�$}��@�U1��UѲsv�x���� �����s/�b�Q )�?(�(��jw�N`V�A�� �;�K/�P��37�d�h�������[U�&�5��#*_yr���I�$;����4L'��]���X�t�*|(��K�ʚq�����fl�&HI��i��7-��۰Qr���"V~�,˜_^�sr{�3ҧݝ�q�t�V�IR���~#E��XN�����^�������j,��?[�����<H"��'j�p�M�*qS Pk�[��u�&@�Zw|���`K�����Tetϋ~��+�.zG@�����`�5����S������h��?L�t�E�a:\ �fޏ/�C�Ʒ�7R�ܚΧ�7��g`E�-����a��F�w1�0s�3B�W�3 �Fi����ب�%�U� ���I�`�9���@x�^ef h�6��uc�:�?a�V�*e���`��@?�;�v��R�da�/�<��)(������+��M�a�?�җO< ����k�o �}\.�����ic �q�6/l�:�8�����I��c\6�N��Dc���zf�ؐկ�_Ψɓ���{�9C���!2����T!)*�n�|�D�YB)�����7'FSЧ#�D<�'⿸�G���N�е�ZWY�II�ƨF�{n}�z)�9fjz��h���dN��/���r<p,�[����r�q#�̴,r��mp6U������b��� �g�/��Y�n�� ,a;Qsɺd�R��,�/\;����� �\��� h �]�g�@)c�~�a�7��梮+oc�']� ��>y;��j@��w��jNC#�@n��� �1t6k�����w��);)�����xyl��w����lrR)k�8dp=��J������+���ؒ�!�~]xͧ�+����S�1��~~d-�ԏ�G�w^x=Ȥ��m+ j��k�ͬ�^�'��61�2֥ȡ2O��I_�ph��S���XB��`0��&�����I/��h��3a� � ��+��w�}�9�<Ëu��W�ͺ͢vFg�������v�G�e&+ t�_T��)B����nd5�q��x��K�|��!\'��!S�k��M���';��R�~~��o�Vȼ�k�cIRux�5��d���G� �� �$�vxp�Yh�s;G�s���^[��[^��i�H������E���~a��r^q�л#+�*���e����KjAݡL��H������̣�>e���Q�3�V��Qׅ�XN��\;#INJ�b<�bd�A�Vq�2K�C����9������������&�Mpd�d��(A�Lx��]��a�d!eU�x���N��ޗ���m��8"{�z���'�ڂ� � Y=�����X��Kߠ?y(љ2��5]���?fpϔCWm��H��g����t��\����OFsEֆ�6�`}=��k�l]]m;|�}l�7������¾A��m"���ǿ���J�^�~�W�5����r3�bzYY{G¦Δ�c�+IB� �9���aߏW�z,}��VKٔ�\���^�@>[TLz�5��`MVp�1���/#X�%{����:S������"'s��)q�B��g�d�� <=5˃LC÷�N܋%�_�d�EL�/bO�& k��&9ݫR���G�[���O�!-Q���ni��U� HY����f%�ߖC�R�iW>$��q�0��^�%�Tھ��/V���>�j��*_G9y �ɟ�H-���6��AL���6|�l2����^SH�[%�Y����c��Z}@�撳R^��vRX����,t��o �븲L�{�X�|P�ˌ0�Njc�F��q�Y+���k#��+B���2�5�xkv�^���2Z�Y�9$�|`>�j��.�<c>� ��Gufsl����$�'��Fܗ2�g[����m��l��ة��\���Y��������Z9Ae�,����@6����7e��9��%pb�����r{4H�X���|A�;�%h$R.�ۿ�:����K\!�_<2��nKx�Vc�]'g�����/��mx�PU �Wy8K���f�B�3�p�D�>0�W5y�:��L�Yd�Uڄ���hi��%���,we^ԙ�YD <���ޔw�tkM��>��ۘ��K�=�o9k��ۧn̸�2�@.���[��O��BOH��M�=�RU���)���q9���"]�v� /�/UM���Wc%��km�f�?��|�� �pk�4�[Ij�?/�)Y����v�? ����J����ml$�<:{i%��-u��d�O�� ^#sB��|]���z�G}���DJ3_������xF3�Ĝۃ��kk�T�:��c.vC�Mu���CO��tZӆ�O�II)<��B�{A|<�a�,;��:���������lr���D^�GJM%B��Z� �%j2��|�`/km[��n���!)7�f�`Z�u�c"��S�?�ĥ7��f��Vm���DLֵ�0���7�'rL�C��ix �Ͷ0a#)�� ���| x1c/y@�W��8`��-���8/M�O7���`N&�'t��:������'��"���T�o���� ;�CV $U��r!�~j�Y�2�oI��I���L�F���ZUº���4`ľ��������"fA]� WE��?�5P7 ��#Ӟ�V��n�S�ċF���a~L����"�h���i���)o�%i���m"P�&�+�]��0��cX����X����Z�SS�#���T:� q�Ԥ1T a������ i��P�#e��{�&�)5�1�\�\ː��9�(,����`#|>;-R �$r钋6�x\z���������\���`{�{� I���q���G���r"r�1�<%�ҢA^���_�0A`u�
Static task
static1
Behavioral task
behavioral1
Sample
Aperion.exe
Resource
win10v2004-20230220-en
General
-
Target
Aperion.exe
-
Size
6.2MB
-
MD5
be4af6084bedc3ad2022a1207fcb91a4
-
SHA1
8b63efba4ab90f35b3fc0de0c93737c4c6b51753
-
SHA256
5c05546ca6e606820eaf0f6d4aea572a674d5ac5a5510613c2454da649ab8521
-
SHA512
541336bc8f3b51bc8840bf56fc8c84d07cf0f21b23bed232be5f1dd59a1d97df56aed9b677ae38ad3f10ea41da2337a70b3cf4aac486c0e670c9e31170107042
-
SSDEEP
196608:+wzbtLFIWecKAqUdTSL/Ypl1CaOHZy9unWI:+wVL6Wec5wMD1CpQ
Malware Config
Signatures
Files
-
Aperion.exe.exe windows x64
81b761ae61eae8c237027aad91b4e920
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
WinExec
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowLongA
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
BitBlt
advapi32
OpenSCManagerA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
ws2_32
select
d3d9
Direct3DCreate9Ex
d3dx9_43
D3DXCreateTextureFromFileA
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
ntdll
NtRaiseHardError
gdiplus
GdipCloneImage
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateContext
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-stdio-l1-1-0
_write
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-runtime-l1-1-0
abort
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-filesystem-l1-1-0
_wremove
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
_dclass
shell32
ShellExecuteA
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 826KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 246KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 654KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
1 Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ