Aqua[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Aqua.exe
Size 888KB
Sample260808-j7mfjsbr7z
SHA256 9225f8be7218c6fd13b13d962c55ecb40b2f7ea27c9bfa09b2d8a2f7bb922363
MD5 6ecd5b7c1badba0311eb7e5168162120
SHA1 26dc31e561a30fd5be32b2d1fca9fb10ba8ced7a
SHA512 d411e770a19cc7546eb0e59f024038d1aa972cd643bc85c13200406719f2ff5e9dab22774628583ab0ee30f87ef416e5636fb93fa273790ba0c54b22a0d96199
SSDEEP 24576:A3ZGM4gJ8yqcOoOtvF4SJ8nuWyuIJ8wvjMw3MBl05Y:ogpyXO34lnGuIJ8wv/3MBl
TLSH
T1BB15CF19B29402BCE077D178CA979713F772780903369AEB27E196662F5B5E09E3F700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Aqua.exe

File Explorer

Aqua.exe

.exe 888KB

Aqua.exe

IMPHASH c1241c047809db1d3f0e536df58bdded
SHA256 9225f8be7218c6fd13b13d962c55ecb40b2f7ea27c9bfa09b2d8a2f7bb922363
MD5 6ecd5b7c1badba0311eb7e5168162120
SHA1 26dc31e561a30fd5be32b2d1fca9fb10ba8ced7a
SHA512 d411e770a19cc7546eb0e59f024038d1aa972cd643bc85c13200406719f2ff5e9dab22774628583ab0ee30f87ef416e5636fb93fa273790ba0c54b22a0d96199
SSDEEP 24576:A3ZGM4gJ8yqcOoOtvF4SJ8nuWyuIJ8wvjMw3MBl05Y:ogpyXO34lnGuIJ8wv/3MBl
TLSH
T1BB15CF19B29402BCE077D178CA979713F772780903369AEB27E196662F5B5E09E3F700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

486912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kuzey\Downloads\Aqua-Free-ImGui-Loader-master\Aqua-Free-ImGui-Loader-master\x64\Release\Aqua.pdb

d3d9

Direct3DCreate9

d3dx9_43

D3DXCreateTextureFromFileInMemoryEx

winhttp

WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpSendRequest

ws2_32

WSAGetLastError setsockopt htons htonl recv connect accept socket send WSAStartup inet_pton listen closesocket bind

secur32

EncryptMessage AcquireCredentialsHandleW FreeCredentialsHandle DeleteSecurityContext QueryContextAttributesW AcceptSecurityContext DecryptMessage InitializeSecurityContextW FreeContextBuffer

bcrypt

BCryptEncrypt BCryptDecrypt BCryptFinalizeKeyPair BCryptGetProperty BCryptGenerateKeyPair BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptGenRandom BCryptExportKey BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash

crypt32

CertFindCertificateInStore CryptDecodeObjectEx CertCreateSelfSignCertificate CertFreeCertificateContext CryptStringToBinaryA CryptBinaryToStringA PFXExportCertStore CertCloseStore CertStrToNameA CertOpenStore PFXImportCertStore CryptImportPublicKeyInfoEx2

advapi32

CryptGetHashParam CryptReleaseContext CryptAcquireContextW CryptDestroyHash CryptHashData CryptCreateHash

kernel32

DeviceIoControl OutputDebugStringA WriteFile FindNextFileW FindFirstFileW GetModuleFileNameA ReadFile GetModuleHandleW GetModuleFileNameW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency LoadLibraryA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoA CreateNamedPipeW FindClose CreateMutexA WaitForSingleObject CreateFileW CreateToolhelp32Snapshot Sleep GetTickCount64 GetLastError Process32NextW CreateFileA Process32FirstW CloseHandle CreateFileMappingA LocalFree CreateProcessW GetSystemTime SetConsoleTitleW ConnectNamedPipe FlushFileBuffers GetExitCodeProcess Beep GlobalUnlock WideCharToMultiByte MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock

user32

GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW DestroyWindow SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW CreateWindowExW SetCapture

shell32

ShellExecuteA

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

dwmapi

DwmSetWindowAttribute DwmExtendFrameIntoClientArea

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBADD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ _Mtx_unlock _Xtime_get_ticks ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ _Query_perf_counter _Strcoll ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z __crtLCMapStringA _Mtx_lock ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Strxfrm _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __C_specific_handler wcsrchr __current_exception_context __std_type_info_compare __std_exception_copy memchr __RTtypeid memcmp memcpy memmove memset strstr __std_terminate _CxxThrowException __std_exception_destroy strchr

api-ms-win-crt-stdio-l1-1-0

fgetc __stdio_common_vsnwprintf_s _set_fmode __stdio_common_vsprintf_s __stdio_common_vsscanf ftell __acrt_iob_func fgetpos setvbuf ungetc fsetpos _fseeki64 _get_stream_buffer_pointers __stdio_common_vswprintf_s fputc fflush __p__commode fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf fseek fclose

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode realloc _callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp strcpy_s strlen strcmp tolower wcslen wcscpy_s wcscat_s

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_exe _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table _get_narrow_winmain_command_line _initialize_narrow_environment _c_exit _beginthreadex terminate _configure_narrow_argv _exit _errno exit _crt_atexit _initterm_e _set_app_type _initterm

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

expf fmodf cosf __setusermatherr ceilf sqrtf sinf acosf

api-ms-win-crt-locale-l1-1-0

___lc_collate_cp_func _configthreadlocale ___lc_locale_name_func