AeroSwap(1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AeroSwap(1).exe
Size 33.3MB
Sample261024-vwpmbacz5m
SHA256 2faa60d6b848da0b703513e5d4dfc3862cb6f0a7b875c2a5e44f44740aa2edab
MD5 209e8a106f3a8d931c12263177596fe5
SHA1 f075998d97977a75094cb10e5722fbd1e87c1616
SHA512 2ef6bfc40efaab2d2fbd1774c8661742c6bf799c865436040ef142a1d899bf0c3c2ecc7c84b6c9c16d04bb0f3f6b2f2fea29dd3eb0df31f9e6c305760e0990bf
SSDEEP 786432:47vAX8vv54OWMTZrsSMN7n1gnhSpirEe4HB:47vAX8vv54OWMTZrs1J1ghGiV4
TLSH
T152775C247E5A996CD05AC4B4834B4A620A7130DB1B35BAFF48C552783F7DBF46E38329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AeroSwap(1).exe

File Explorer

AeroSwap(1).exe

.exe 33.3MB

AeroSwap(1).exe

IMPHASH cde24577b11e52dda0feeb4fadff035a
SHA256 2faa60d6b848da0b703513e5d4dfc3862cb6f0a7b875c2a5e44f44740aa2edab
MD5 209e8a106f3a8d931c12263177596fe5
SHA1 f075998d97977a75094cb10e5722fbd1e87c1616
SHA512 2ef6bfc40efaab2d2fbd1774c8661742c6bf799c865436040ef142a1d899bf0c3c2ecc7c84b6c9c16d04bb0f3f6b2f2fea29dd3eb0df31f9e6c305760e0990bf
SSDEEP 786432:47vAX8vv54OWMTZrsSMN7n1gnhSpirEe4HB:47vAX8vv54OWMTZrs1J1ghGiV4
TLSH
T152775C247E5A996CD05AC4B4834B4A620A7130DB1B35BAFF48C552783F7DBF46E38329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16599840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aero_swap.pdb

bcryptprimitives

ProcessPrng

kernel32

ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce ReleaseSRWLockExclusive TlsGetValue TlsSetValue WideCharToMultiByte LoadLibraryW ReleaseSemaphore InitializeSRWLock TlsAlloc TerminateProcess QueryFullProcessImageNameW OpenProcess CloseHandle WaitForSingleObject GetProcAddress CreateSemaphoreA SetConsoleCtrlHandler MoveFileExW CreateMutexW CreatePipe Sleep SetFileAttributesW CreateFileW SetNamedPipeHandleState GetModuleHandleA GetCurrentProcess GetModuleHandleW SetLastError LoadLibraryExW GetModuleFileNameW OutputDebugStringW OutputDebugStringA GetCurrentThreadId SetHandleInformation GetStdHandle GetConsoleMode LCIDToLocaleName GetProcessHeap HeapFree GetUserDefaultUILanguage ReleaseMutex HeapAlloc FreeLibrary EncodePointer FlsGetValue RaiseException RtlPcToFileHeader GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable LoadLibraryA lstrlenW GetLastError LoadLibraryExA FormatMessageW GetFileInformationByHandle GetFileAttributesW CancelIoEx CreateIoCompletionPort SetFileCompletionNotificationModes PostQueuedCompletionStatus GetQueuedCompletionStatusEx WriteFile ReadFile GetOverlappedResult FindNextFileW QueryPerformanceFrequency GetTempPathW WaitForMultipleObjects InitializeCriticalSectionEx IsThreadAFiber SetUnhandledExceptionFilter FlsSetValue GetModuleHandleExW FlsAlloc InitializeSListHead FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW RtlUnwindEx DeleteCriticalSection CreateJobObjectW SetInformationJobObject AssignProcessToJobObject CreateToolhelp32Snapshot Process32FirstW Process32NextW MultiByteToWideChar SystemTimeToTzSpecificLocalTime SystemTimeToFileTime RtlVirtualUnwind GetEnvironmentVariableW CompareStringOrdinal FreeEnvironmentStringsW GetFullPathNameW SetFileInformationByHandle DuplicateHandle CopyFileExW HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx SleepEx WriteFileEx RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime CancelIo SetFileTime GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetProcessId GetEnvironmentStringsW GetExitCodeProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WaitForSingleObjectEx CreateMutexA GetFinalPathNameByHandleW CreateSymbolicLinkW DeviceIoControl DeleteFileW SetEnvironmentVariableW

advapi32

RegCloseKey OpenProcessToken RegOpenKeyTransactedW RegQueryValueExW RegCreateKeyExW RegGetValueW RegSetValueExW RegDeleteValueW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation EventRegister SystemFunction036 GetTokenInformation RegCreateKeyTransactedW

oleaut32

SysStringLen SysFreeString SetErrorInfo GetErrorInfo

ntdll

RtlGetVersion NtWriteFile NtCreateFile NtOpenFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError

user32

IsWindowEnabled SetWindowTextW IsProcessDPIAware GetDC GetWindowRect GetParent FindWindowExW SetWindowRgn CheckMenuItem SetMenuItemInfoW MapWindowPoints CreateAcceleratorTableW SetForegroundWindow DrawIconEx SetParent GetWindow RegisterWindowMessageA RegisterRawInputDevices DestroyAcceleratorTable MsgWaitForMultipleObjectsEx SetCapture ReleaseCapture SendInput DestroyIcon GetSystemMenu ReleaseDC SetWindowLongPtrW GetWindowLongPtrW GetWindowTextW EnableMenuItem SetPropW SystemParametersInfoA GetRawInputData ShowWindow SetWindowLongW ShowCursor FindWindowW GetClipCursor ClipCursor SetWindowDisplayAffinity IsWindowVisible GetMenu GetKeyboardLayout GetKeyboardState EnableWindow GetAsyncKeyState GetKeyState MapVirtualKeyExW RegisterClassExW CreateWindowExW ToUnicodeEx DefWindowProcW CreateIcon TranslateAcceleratorW GetMenuItemInfoW GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos SetMenu FlashWindowEx InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SetFocus SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect DrawMenuBar GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient CreateMenu LoadCursorW GetUpdateRect MapVirtualKeyW ValidateRect DrawTextW GetWindowDC PostThreadMessageW PeekMessageW PostMessageW DispatchMessageW GetMessageW OffsetRect CreatePopupMenu MonitorFromPoint GetMenuBarInfo VkKeyScanW DestroyMenu RegisterTouchWindow GetSystemMetrics IsWindow AdjustWindowRectEx IsIconic SendMessageW EnumChildWindows TrackPopupMenu PostQuitMessage SetWindowPos GetWindowTextLengthW RedrawWindow AdjustWindowRect RemoveMenu AppendMenuW DispatchMessageA TranslateMessage GetMessageA DestroyWindow EnumDisplayMonitors InsertMenuW

ole32

CoTaskMemAlloc RegisterDragDrop CoCreateFreeThreadedMarshaler CoCreateInstance OleInitialize RevokeDragDrop CoInitialize CoUninitialize CoTaskMemFree CoInitializeEx

gdi32

CreateRectRgn DeleteDC SetBkMode SetTextColor DeleteObject CreateSolidBrush CombineRgn SelectObject CreateDIBSection CreateCompatibleDC GetDeviceCaps BitBlt

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc TaskDialogIndirect

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

shell32

ShellExecuteExW DragFinish DragQueryFileW SHGetKnownFolderPath ShellExecuteW SHAppBarMessage SHCreateItemFromParsingName ord155 SHOpenFolderAndSelectItems ord190

ws2_32

WSAStartup getaddrinfo freeaddrinfo WSAGetLastError socket WSAIoctl setsockopt shutdown WSASocketW listen WSACleanup send recv connect ioctlsocket WSASend accept getsockopt getsockname getpeername closesocket bind

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertOpenStore CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CertCloseStore CertSetCertificateContextProperty CertFreeCertificateChain CertFreeCertificateContext

bcrypt

BCryptGenRandom

dnsapi

DnsFlushResolverCache

wininet

InternetSetOptionW

iphlpapi

GetExtendedTcpTable

api-ms-win-crt-string-l1-1-0

strcpy_s strcmp wcslen _wcsicmp wcscmp strlen

api-ms-win-crt-math-l1-1-0

floor round pow roundf __setusermatherr trunc

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc terminate _exit _errno exit _wassert _initialize_onexit_table abort _seh_filter_exe _set_app_type _crt_atexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e

api-ms-win-crt-convert-l1-1-0

_wtoi strtol wcstol _ultow_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

feof _set_fmode __stdio_common_vsscanf _setmode fwrite ftell fseek fread _fileno __p__commode fopen fgets ferror __stdio_common_vsprintf fclose __acrt_iob_func fflush __stdio_common_vfprintf

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode realloc malloc free

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale