aurorium[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
aurorium.exe
Size 8.3MB
Sample260928-dp89psvvex
SHA256 0aba3432ba32146fb25c934308aefdf19de941acc8e83df8d721072f1a16c425
MD5 8b0db6750c2f75526b1d0c40566edfec
SHA1 690ad69e42da8a2d731a5a227988eac28cafc470
SHA512 d778385fb237d84330189fadcf715dd2c3d3953f799305c03d10bf86e24f3439608d5a2552c918599a8f70d84f918e119c2d13eaa559169873f21186b6fd7ca3
SSDEEP 98304:ngTGXGHjT8lT4hgPXpnIoAD4zjS/2fKuiDxwu5i+7BnoM:nwePXZJS/ohAxwu5iWBno
TLSH
T119965C43F76281E9D56AC074871A6233FB72B849073476EB5BE08A213F62FE05A3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aurorium.exe

File Explorer

aurorium.exe

.exe 8.3MB

aurorium.exe

IMPHASH 3f6b970e16b3ea5529384970f240eb65
SHA256 0aba3432ba32146fb25c934308aefdf19de941acc8e83df8d721072f1a16c425
MD5 8b0db6750c2f75526b1d0c40566edfec
SHA1 690ad69e42da8a2d731a5a227988eac28cafc470
SHA512 d778385fb237d84330189fadcf715dd2c3d3953f799305c03d10bf86e24f3439608d5a2552c918599a8f70d84f918e119c2d13eaa559169873f21186b6fd7ca3
SSDEEP 98304:ngTGXGHjT8lT4hgPXpnIoAD4zjS/2fKuiDxwu5i+7BnoM:nwePXZJS/ohAxwu5iWBno
TLSH
T119965C43F76281E9D56AC074871A6233FB72B849073476EB5BE08A213F62FE05A3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6472784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aurorium.pdb

kernel32

SetHandleInformation GetModuleHandleA WriteConsoleW CreateFileA GetConsoleOutputCP SetLastError GetCurrentThreadId GetFullPathNameW SetFileTime AreFileApisANSI GetDiskFreeSpaceW LockFile CreateFileW SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CancelIoEx WriteFile DeleteFileA CreateIoCompletionPort GetOverlappedResult ReadFile GetQueuedCompletionStatusEx UnlockFile GetTempPathA SetWaitableTimer CreateWaitableTimerExW SetConsoleMode SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterA GetConsoleScreenBufferInfo GetFileInformationByHandleEx GetConsoleMode GetStdHandle SetThreadStackGuarantee LocalFree CreateMutexW LockFileEx GetFileAttributesW CreateThread SetFileInformationByHandle MoveFileExW PostQueuedCompletionStatus GetDiskFreeSpaceA GetFileSize SwitchToThread WaitForSingleObject FormatMessageW GetLastError HeapAlloc HeapFree FindFirstFileExW FlushFileBuffers TlsSetValue TlsGetValue GetProcessHeap TlsAlloc InitOnceExecuteOnce UnmapViewOfFile MapViewOfFile WideCharToMultiByte RtlVirtualUnwind GetFileAttributesA Sleep ReleaseMutex GetFileAttributesExW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock CreateSymbolicLinkW CreateMutexA FindNextFileW FindClose GetFileInformationByHandle CreateDirectoryW SetFilePointerEx GetFinalPathNameByHandleW GetCurrentProcessId DeleteFileW SetFileCompletionNotificationModes GetFileType lstrlenW LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetProcAddress GetCurrentThread CloseHandle SystemTimeToFileTime FreeLibrary GetTimeZoneInformationForYear SetUnhandledExceptionFilter GetSystemTimePreciseAsFileTime InitializeSListHead HeapReAlloc GetSystemInfo AddVectoredExceptionHandler QueryPerformanceCounter QueryPerformanceFrequency GetCurrentDirectoryW MultiByteToWideChar GetEnvironmentVariableW GetModuleHandleW LoadLibraryW GetTickCount CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime HeapDestroy HeapCompact GetNativeSystemInfo FlushViewOfFile OutputDebugStringW HeapSize HeapValidate OutputDebugStringA HeapCreate RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

NtCancelIoFileEx NtReadFile NtDeviceIoControlFile RtlNtStatusToDosError NtCreateFile NtWriteFile

ws2_32

WSAStartup getaddrinfo setsockopt freeaddrinfo WSAIoctl ioctlsocket recv WSASend send getsockname getpeername accept listen bind WSAGetLastError getsockopt connect closesocket shutdown WSACleanup WSASocketW

bcryptprimitives

ProcessPrng

crypt32

CertFreeCertificateContext CertCreateCertificateChainEngine CertCloseStore CertAddEncodedCertificateToStore CertOpenStore CertSetCertificateContextProperty CertFreeCertificateChain CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChainEngine

vcruntime140

__current_exception_context __current_exception __C_specific_handler strrchr memcpy memchr memcmp __CxxFrameHandler3 strchr memset memmove

api-ms-win-crt-string-l1-1-0

strlen strncmp strcspn strspn strcmp

api-ms-win-crt-math-l1-1-0

__setusermatherr pow trunc truncf log round

api-ms-win-crt-runtime-l1-1-0

terminate _errno _beginthreadex _endthreadex _seh_filter_exe _set_app_type _initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _register_onexit_function abort _crt_atexit exit _exit _wassert _initterm_e __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

_setmode fwrite ftell fseek fread _set_fmode _fileno fopen fgets ferror feof fclose __p__commode __acrt_iob_func fflush __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

_set_new_mode _msize realloc malloc free

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale