Edit tour

Windows Analysis Report
Aura.exe

Overview

General Information

Sample name:	Aura.exe
Analysis ID:	1543669
MD5:	d4c99337bc1f8e9ba7c0cf81dd01c39d
SHA1:	e34e7fc7d3f41fe73dc5735b9ee7ed41f198543f
SHA256:	714d338600b157fe68e58271223bc1387e1e63f8c3511e4e76faa774269e30a6
Tags:	exeuser-4k95m
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found potential dummy code loops (likely to delay analysis)

Abnormal high CPU Usage

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

Program does not show much activity (idle)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Aura.exe (PID: 7576 cmdline: "C:\Users\user\Desktop\Aura.exe" MD5: D4C99337BC1F8E9BA7C0CF81DD01C39D)

conhost.exe (PID: 7592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Aura.exe

ReversingLabs: Detection: 23%

Source: Aura.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Aura.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_02C008E3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_02C008E3

Source: C:\Users\user\Desktop\Aura.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00615FC0	0_2_00615FC0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_00073040	0_2_00073040
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02C173EC	0_2_02C173EC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF43DF	0_2_02BF43DF
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF3320	0_2_02BF3320
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF4080	0_2_02BF4080
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02C11060	0_2_02C11060
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF51FC	0_2_02BF51FC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02C106E0	0_2_02C106E0
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BD2689	0_2_02BD2689
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BFD62E	0_2_02BFD62E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF3671	0_2_02BF3671
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF473D	0_2_02BF473D
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF55FF	0_2_02BF55FF
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF4AAA	0_2_02BF4AAA
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF39B3	0_2_02BF39B3
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF4E08	0_2_02BF4E08
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF2FDE	0_2_02BF2FDE
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02C10C10	0_2_02C10C10
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BF3D12	0_2_02BF3D12
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_032302D9	0_2_032302D9
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_0322F769	0_2_0322F769
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_03243439	0_2_03243439

Source: C:\Users\user\Desktop\Aura.exe

Code function: String function: 02BD2400 appears 48 times

Source: Aura.exe

Static PE information: invalid certificate

Source: Aura.exe

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Aura.exe, 00000000.00000002.4198306856.00000000008AA000.00000002.00000001.01000000.00000003.sdmp

Binary or memory string: OriginalFilenameGypsite.exe0 vs Aura.exe

Source: Aura.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal52.evad.winEXE@2/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7592:120:WilError_03

Source: Aura.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Aura.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Aura.exe

ReversingLabs: Detection: 23%

Source: Aura.exe

String found in binary or memory: kelxU/Add0J82/ih1W

Source: unknown	Process created: C:\Users\user\Desktop\Aura.exe "C:\Users\user\Desktop\Aura.exe"
Source: C:\Users\user\Desktop\Aura.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\Aura.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Aura.exe	Section loaded: iphlpapi.dll	Jump to behavior

Source: Aura.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Aura.exe

Static file information: File size 9910848 > 1048576

Source: Aura.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x627800
Source: Aura.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1c7600
Source: Aura.exe	Static PE information: Raw size of .reloc is bigger than: 0x100000 < 0x117600

Source: Aura.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Aura.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Aura.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Aura.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Aura.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Aura.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Aura.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Aura.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Aura.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BED0F0 pushfd ; retn 0001h	0_2_02BED0F3
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BD80CF push edi; ret	0_2_02BD80D8
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BD2450 push ecx; ret	0_2_02BD2463
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02C18E1B push ecx; ret	0_2_02C18E2E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_030D2BE7 push BA00000Dh; retf 0045h	0_2_030D2BEC
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_030D4A0B push ecx; ret	0_2_030D4A0E
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_030D2667 push BA00000Bh; retf 0045h	0_2_030D266C

Source: C:\Users\user\Desktop\Aura.exe

API coverage: 2.0 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_02C008E3 FindFirstFileExW,FindNextFileW,FindClose,FindClose,

0_2_02C008E3

Source: Aura.exe, 00000000.00000000.1736682099.0000000000679000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: 0bFFEavMX868V1V
Source: Aura.exe	Binary or memory string: 7xe0UmVMCiEVpz69WTVnv/v
Source: Aura.exe, 00000000.00000002.4198269188.000000000085A000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: ME55ko1LvmcIW74D5zFCUY

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\Aura.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_02BD21A6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_02BD21A6

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_030D0225 mov eax, dword ptr fs:[00000030h]

0_2_030D0225

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_02BD10B0 GetProcessHeap,RtlAllocateHeap,

0_2_02BD10B0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BD2336 SetUnhandledExceptionFilter,	0_2_02BD2336
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BD21A6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02BD21A6
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BFF6A6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_02BFF6A6
Source: C:\Users\user\Desktop\Aura.exe	Code function: 0_2_02BD29D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_02BD29D0

Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_02C0725D
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_02C070BE
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_02C067D4
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_02C07BA4
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_02C06BB6
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_02C068D8
Source: C:\Users\user\Desktop\Aura.exe	Code function: EnumSystemLocalesW,	0_2_02C0683D
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_02C06963
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_02C06EBB
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_02C06CDF
Source: C:\Users\user\Desktop\Aura.exe	Code function: GetLocaleInfoW,	0_2_02C06DE5

Source: C:\Users\user\Desktop\Aura.exe

Code function: 0_2_0062F4BD GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_0062F4BD

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Aura.exe	24%	ReversingLabs	Win32.Trojan.Sonbokli

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1543669
Start date and time:	2024-10-28 08:30:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Aura.exe
Detection:	MAL
Classification:	mal52.evad.winEXE@2/0@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: Aura.exe

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.66267330776498
TrID:	Win32 Executable (generic) a (10002005/4) 99.53% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Aura.exe
File size:	9'910'848 bytes
MD5:	d4c99337bc1f8e9ba7c0cf81dd01c39d
SHA1:	e34e7fc7d3f41fe73dc5735b9ee7ed41f198543f
SHA256:	714d338600b157fe68e58271223bc1387e1e63f8c3511e4e76faa774269e30a6
SHA512:	bdf076559bcde714f35fadae3947082fb54dc76f7122707494eb87f7b9a1e272a2fd41ffed15edbd94e7a14df1cdd7dd8970527c3fc4ef6a9f5c7e3e956ee5a4
SSDEEP:	196608:0Hgu5w3LPmN5EYGXr77Mnd5ZoTJKnxr0K4fU9vxZk9/l+HsMmkulCnRUEiNWVb6x:0Hj5w3LPmN5EYGXr77MVM0nxr03fU6Ik
TLSH:	42A6ED4E680E9C44A5606217D4865F6A1CC9AD81BF3A0BEBFC95B2FF01241D59C33A7F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g...............).xb..v4.....<.].......b...@..........................0............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x9df13c
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671BE2EF [Fri Oct 25 18:26:55 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	eb7c8e2246ed8f21359fbcfc99aed6c5

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	06/01/2023 06:40:04 06/01/2026 06:40:04
Subject Chain	CN="Shenzhen Aidapu Network Technology Co.,Ltd.", O="Shenzhen Aidapu Network Technology Co.,Ltd.", L=Shenzhen, S=Guangdong, C=CN
Version:	3
Thumbprint MD5:	E73E5DE59BCF7048F89CC01100EA4DEA
Thumbprint SHA-1:	A2A2F6DEE997A68AF86C9D6BA0F3B1BCFE57D5EF
Thumbprint SHA-256:	397028C1215AD56E4C8D1907AC3D4EB09E0B03E160FA1E2DF50157284B020090
Serial:	55622ADD814777B21B1A1D31

Entrypoint Preview

Instruction
call 00007F656CB6D15Eh
jmp 00007F656CB6CBACh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
push esi
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
movzx eax, word ptr [ecx+14h]
lea edx, dword ptr [ecx+18h]
add edx, eax
movzx eax, word ptr [ecx+06h]
imul esi, eax, 28h
add esi, edx
cmp edx, esi
je 00007F656CB6CDABh
mov ecx, dword ptr [ebp+0Ch]
cmp ecx, dword ptr [edx+0Ch]
jc 00007F656CB6CD9Ch
mov eax, dword ptr [edx+08h]
add eax, dword ptr [edx+0Ch]
cmp ecx, eax
jc 00007F656CB6CD9Eh
add edx, 28h
cmp edx, esi
jne 00007F656CB6CD7Ch
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 00007F656CB6CD8Bh
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
test eax, eax
je 00007F656CB6CDB7h
mov ecx, 00005A4Dh
cmp word ptr [eax], cx
jne 00007F656CB6CDADh
mov ecx, dword ptr [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 00004550h
jne 00007F656CB6CDA0h
mov eax, 0000010Bh
cmp word ptr [ecx+18h], ax
sete al
pop ebp
ret
xor al, al
pop ebp
ret
mov eax, dword ptr fs:[00000018h]
ret
push esi
call 00007F656CB6D9D1h
test eax, eax
je 00007F656CB6CDB2h
mov eax, dword ptr fs:[00000018h]
mov esi, 00C57FB4h
mov edx, dword ptr [eax+04h]
jmp 00007F656CB6CD96h
cmp edx, eax
je 00007F656CB6CDA2h
xor eax, eax
mov ecx, edx
lock cmpxchg dword ptr [esi], ecx
test eax, eax
jne 00007F656CB6CD82h
xor al, al
pop esi
ret
mov al, 01h
pop esi
ret
call 00007F656CB6D9A0h
test eax, eax
je 00007F656CB6CD99h
call 00007F656CB6D66Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7ef194	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x85a000	0x4d5	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x96de00	0x5c40
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x85b000	0x1175c0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x7edf20	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x7ede60	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x629000	0x358	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x62769f	0x627800	56755bbeb2aa8ae435fbfde593ebbb8b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x629000	0x1c74aa	0x1c7600	d61ab7402d75b80cec30b8173101fbfc	False	0.7442585738059292	data	5.917949947136093	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x7f1000	0x68268	0x67000	f4bcd7746021d590ec2308b36652d92a	False	0.7477363660497572	data	5.878707487767622	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x85a000	0x4d5	0x600	7aee915e6de36af820411a29e1aa5102	False	0.3880208333333333	data	3.621108244312337	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x85b000	0x1175c0	0x117600	d7e671631b8a68184d70c7456de52578	False	0.19583857662192394	data	6.6587668751390305	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x85a0a0	0x2b8	COM executable for DOS	English	United States	0.46120689655172414
RT_MANIFEST	0x85a358	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
KERNEL32.dll	SetFilePointerEx, WriteFile, IsDebuggerPresent, EncodePointer, DecodePointer, CloseHandle, DuplicateHandle, SetHandleInformation, RaiseException, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetLastError, SetLastError, CreatePipe, PeekNamedPipe, HeapAlloc, HeapFree, HeapSize, GetProcessHeap, EnterCriticalSection, TryEnterCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, ReleaseMutex, WaitForSingleObject, WaitForSingleObjectEx, CreateEventA, CreateEventW, SignalObjectAndWait, InterlockedPopEntrySList, InterlockedPushEntrySList, InterlockedFlushSList, GetCurrentProcess, GetCurrentProcessId, ExitProcess, TerminateProcess, GetExitCodeProcess, CreateThread, GetCurrentThreadId, GetThreadPriority, TerminateThread, TlsAlloc, TlsGetValue, CreateProcessA, GetStartupInfoW, SetPriorityClass, GetThreadTimes, IsProcessorFeaturePresent, GetLocalTime, GetTickCount, GetVersionExW, GetLogicalProcessorInformation, VirtualAlloc, VirtualProtect, VirtualFree, ChangeTimerQueueTimer, ReadFile, FreeLibrary, FreeLibraryAndExitThread, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetProcAddress, LoadLibraryExW, LoadLibraryA, LoadLibraryW, LocalAlloc, LocalFree, GetProcessAffinityMask, CreateSemaphoreA, CreateFileMappingA, RegisterWaitForSingleObject, UnregisterWait, CompareStringW, GetStringTypeW, MultiByteToWideChar, WideCharToMultiByte, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, LCMapStringW, AllocConsole, AttachConsole, GetConsoleCP, GetConsoleMode, WriteConsoleW, GetFileSizeEx, ReadConsoleW, GetConsoleOutputCP, FlushFileBuffers, HeapReAlloc, SetConsoleCtrlHandler, GetTimeFormatW, GetDateFormatW, GetTempPathW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetLocaleInfoW, SetStdHandle, SetEnvironmentVariableW, FindNextFileW, FindFirstFileExW, OutputDebugStringW, GetCurrentThread, GetModuleHandleExW, TlsFree, TlsSetValue, InitializeCriticalSectionAndSpinCount, LeaveCriticalSection, RtlUnwind, InitializeSListHead, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetFileType, GetFileAttributesExW, GetFileAttributesA, FindNextFileA, FindFirstFileExA, FindClose, DeleteFileA, CreateFileW, SetEnvironmentVariableA, SetEndOfFile, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, DeleteTimerQueueTimer, GetStdHandle
USER32.dll	EnumDisplayMonitors, LoadCursorA, GetCursorPos, MessageBoxA, GetWindowRect, GetWindowTextA, SetWindowTextA, RemovePropA, FindWindowA, SetPropA, RedrawWindow, InvalidateRect, EndPaint, BeginPaint, ReleaseDC, SetActiveWindow, GetMenuItemInfoA, TrackPopupMenu, GetParent, SetWindowLongA, GetWindowLongA, FrameRect, GetSysColorBrush, GetPropA, GetSysColor, GetMessageA, DispatchMessageA, PostMessageA, ModifyMenuA, AppendMenuA, EnableMenuItem, DestroyMenu, CreatePopupMenu, CreateMenu, SetMenu, TranslateAcceleratorA, LoadAcceleratorsA, KillTimer, IsDlgButtonChecked, CheckRadioButton, CheckDlgButton, GetDlgItem, EndDialog, DialogBoxParamA, CreateDialogParamA, SetWindowPos, ShowWindow, DestroyWindow, CreateWindowExA, CallWindowProcA, PostQuitMessage, LoadStringA
GDI32.dll	SelectObject, Rectangle, DeleteObject, CreateFontIndirectA, GetObjectA, CreateSolidBrush
COMDLG32.dll	GetSaveFileNameA, GetOpenFileNameA
ADVAPI32.dll	AdjustTokenPrivileges, InitiateSystemShutdownA, RegOpenKeyExA, LookupPrivilegeValueA, OpenProcessToken
SHELL32.dll	SHGetMalloc, ShellExecuteA, DragAcceptFiles, DragQueryFileA, SHGetPathFromIDListA, SHBrowseForFolderA
ole32.dll	CoCreateInstance, CoInitialize

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2024 08:31:29.880203009 CET	53	50956	1.1.1.1	192.168.2.4

Target ID:	0
Start time:	03:31:11
Start date:	28/10/2024
Path:	C:\Users\user\Desktop\Aura.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Aura.exe"
Imagebase:	0x50000
File size:	9'910'848 bytes
MD5 hash:	D4C99337BC1F8E9BA7C0CF81DD01C39D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	03:31:11
Start date:	28/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	77.3%
Signature Coverage:	30.3%
Total number of Nodes:	66
Total number of Limit Nodes:	2

Executed Functions

Function 00615FC0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 341
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,0000DFCE), ref: 006164DC

Strings

3u, xrefs: 0061608B
S0, xrefs: 00615FD4
T0, xrefs: 00616060

Memory Dump Source

Source File: 00000000.00000002.4197622188.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.4197565375.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198096655.0000000000679000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198200757.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198214492.0000000000849000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198225849.000000000084A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198236609.000000000084B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198246560.000000000084C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198258510.0000000000858000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198269188.000000000085A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198294388.00000000008A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198306856.00000000008AA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_Aura.jbxd

Similarity

API ID: Message
String ID: S0$3u$T0
API String ID: 2030045667-1701336102
Opcode ID: f43265cb211c2cf0493b3d91200028e97a5ec094df28f8034017333b7bed2e27
Instruction ID: fec6769470d41a07e36ad631e46bc969384748dacc1fc4271036346e712dc504
Opcode Fuzzy Hash: f43265cb211c2cf0493b3d91200028e97a5ec094df28f8034017333b7bed2e27
Instruction Fuzzy Hash: BB0258B0D012599FCB08CFD9D995AEEBBB2FF88304F248169E419BB304D7786A45CB54

Function 030D0445 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000004), ref: 030D0669
VirtualProtect.KERNELBASE(?,?,00000020,?), ref: 030D06BD
VirtualProtect.KERNELBASE(?,?,00000020,?), ref: 030D06DA

Strings

text, xrefs: 030D04E4, 030D04E7
VirtualProtect, xrefs: 030D0601, 030D0604
entrypoint, xrefs: 030D0523, 030D0526
data, xrefs: 030D050E, 030D0511
shell, xrefs: 030D04BA, 030D04BD
kernel32.dll, xrefs: 030D05DC, 030D05DF
VirtualAlloc, xrefs: 030D05EB, 030D05EE

Memory Dump Source

Source File: 00000000.00000002.4198744411.00000000030D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_Aura.jbxd

Similarity

API ID: Virtual$Protect$Alloc
String ID: VirtualAlloc$VirtualProtect$data$entrypoint$kernel32.dll$shell$text
API String ID: 2541858876-1818510656
Opcode ID: be7a6e1042b72d336361a32cedf384822ad5c32e6a9e10eb7333297f1f351802
Instruction ID: 2f3d354bc97d95931c807481a51b251ab2ca0ca4bc42da6b01321fb45114e886
Opcode Fuzzy Hash: be7a6e1042b72d336361a32cedf384822ad5c32e6a9e10eb7333297f1f351802
Instruction Fuzzy Hash: 1FA1E770D083C8DAEF11CBE8D848BDDBFB56F56304F184198D1886B282D7BA5658CB66

Function 02BD1B0B Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___security_init_cookie.LIBCMT ref: 02BD1B0B

Part of subcall function 02BD20C2: ___get_entropy.LIBCMT ref: 02BD20DC

___scrt_release_startup_lock.LIBCMT ref: 02BD1BA7
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 02BD1BBB
___scrt_is_nonwritable_in_current_image.LIBCMT ref: 02BD1BE1
___scrt_uninitialize_crt.LIBCMT ref: 02BD1C2A

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ___scrt_is_nonwritable_in_current_image$___get_entropy___scrt_release_startup_lock___scrt_uninitialize_crt___security_init_cookie
String ID:
API String ID: 2539496024-0
Opcode ID: 7baf70f89fbd3e5ea679976efdc65b3b728baf2d532e1eaf3fb7387379ddaee7
Instruction ID: b84eb666623c834a7e2d868365701f7202a121451a69513eda481c177ca92dbc
Opcode Fuzzy Hash: 7baf70f89fbd3e5ea679976efdc65b3b728baf2d532e1eaf3fb7387379ddaee7
Instruction Fuzzy Hash: 26314631A942419BEB257B7C9C01BDD33629F02764F2809E9E44A6F1D1FF618441EB64

Non-executed Functions

Function 02C06CDF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 02C06D78
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 02C06DA1
GetACP.KERNEL32 ref: 02C06DB6

Strings

ACP, xrefs: 02C06CFD
OCP, xrefs: 02C06D33

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e61529f23036c77b45f2e9ee1b21dcfc3f10744425b212b5fb84feac4da0791b
Instruction ID: 96b7b1e79a72459ce80ec41b66a689b9126d3cce9126a6543817601cb17fbdc9
Opcode Fuzzy Hash: e61529f23036c77b45f2e9ee1b21dcfc3f10744425b212b5fb84feac4da0791b
Instruction Fuzzy Hash: 7D21A432600301EADB348F27C981B9777AEFB90E54B668468E94AD7184F732DF61C790

Function 00073040 Relevance: 7.9, APIs: 5, Instructions: 391memoryCOMMON

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32 ref: 00073171
GetSysColor.USER32 ref: 0007320C
TlsAlloc.KERNEL32 ref: 00073383

Memory Dump Source

Source File: 00000000.00000002.4197622188.0000000000051000.00000020.00000001.01000000.00000003.sdmp, Offset: 00050000, based on PE: true

Associated: 00000000.00000002.4197565375.0000000000050000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198096655.0000000000679000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198200757.0000000000841000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198214492.0000000000849000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198225849.000000000084A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198236609.000000000084B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198246560.000000000084C000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198258510.0000000000858000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198269188.000000000085A000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198294388.00000000008A7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.4198306856.00000000008AA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_50000_Aura.jbxd

Similarity

API ID: AllocColorInformationLogicalProcessor
String ID:
API String ID: 2227743531-0
Opcode ID: c06755a1ab349223febfecfd06f4d577e089db5470d7fcf29f258023203d73d2
Instruction ID: 3395b7b04480ed78b808e9cc052921697c5606c60c941288d2394fd2519a62a6
Opcode Fuzzy Hash: c06755a1ab349223febfecfd06f4d577e089db5470d7fcf29f258023203d73d2
Instruction Fuzzy Hash: BA2247B0D01619DFDB08CFD9D9959AEBBB1FF88304F20816AD419BB204D7386A45DF58

Function 02C06EBB Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 02BFF302: GetLastError.KERNEL32(?,?,02C05D2C,02C2A818,0000000C,02C0A365,00000000,?,02BF966D,00000000,00000000,00000000,00000000,?,?,?), ref: 02BFF306
Part of subcall function 02BFF302: SetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,?,?,02C09138,?,02C08C40,00000000,?,00000000,02C08C40), ref: 02BFF3A8

GetUserDefaultLCID.KERNEL32 ref: 02C06FC3
IsValidCodePage.KERNEL32(00000000), ref: 02C07001
IsValidLocale.KERNEL32(?,00000001), ref: 02C07014
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 02C0705C
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 02C07077

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: b08515faba0968a0444e8e7f6edfed2f520e99fb13c07c3444ee0b0e97a83a64
Instruction ID: 7d2748ff6ac4be24a01e12e4fad7c5c075d036b1a74fca5bf8abfc0646f58351
Opcode Fuzzy Hash: b08515faba0968a0444e8e7f6edfed2f520e99fb13c07c3444ee0b0e97a83a64
Instruction Fuzzy Hash: 57515D71A00215ABEF10EFA5CC81FBAB7BDBF48704F244569E915E71C0E771AA14CBA1

Function 032302D9 Relevance: 6.9, Strings: 5, Instructions: 636COMMON

Download Yara Rule

Strings

:}, xrefs: 0323035D
j|, xrefs: 03230BCA
!K, xrefs: 03230B97
/5, xrefs: 03230A96
uR, xrefs: 03230B20

Memory Dump Source

Source File: 00000000.00000002.4198744411.00000000030D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_Aura.jbxd

Similarity

API ID:
String ID: !K$/5$:}$j|$uR
API String ID: 0-181933845
Opcode ID: c41641d6fb2284d34f79b02710a976b43663cc47193f69a05fc1110f9a6e53bd
Instruction ID: 34790525ebe17db700be803648a353c69f41fe23b196ea9b6e770682f9f75f15
Opcode Fuzzy Hash: c41641d6fb2284d34f79b02710a976b43663cc47193f69a05fc1110f9a6e53bd
Instruction Fuzzy Hash: 166259B0D11619DFCB08CFA9D9959EEBBB2FF88304F24816AE415BB204D7786A41CF54

Function 02C106E0 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b0d6a36d3e9bb07e292145b0f16b39c2ac231c0c763a01576220bd12188bc9c
Instruction ID: 21b26acf96241810ee612bc91b201734df41a4744ba7c3657d3558a49b4c7919
Opcode Fuzzy Hash: 2b0d6a36d3e9bb07e292145b0f16b39c2ac231c0c763a01576220bd12188bc9c
Instruction Fuzzy Hash: 6F022C71E012199BDB14CFA9C8917AEBBF1FF89314F248269D919E7380D731AA41DB90

Function 02C008E3 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 02C0097E
FindNextFileW.KERNEL32(00000000,?), ref: 02C009F9
FindClose.KERNEL32(00000000), ref: 02C00A1B
FindClose.KERNEL32(00000000), ref: 02C00A3E

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Find$CloseFile$FirstNext
String ID:
API String ID: 1164774033-0
Opcode ID: cc9d12012340c03b08d764140dc1f74db546c71a2f86cb108fa7b336e49bb3ce
Instruction ID: fcd7e7a3f170725dd4ddd52e4ce939a3af6da8d0e7320b273349f47f175d9891
Opcode Fuzzy Hash: cc9d12012340c03b08d764140dc1f74db546c71a2f86cb108fa7b336e49bb3ce
Instruction Fuzzy Hash: F841B031D00229AEEB20DF69DCC8BAAB3B9EBC5305F014295E509931C0EB309F80CB60

Function 02BD21A6 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 02BD21B2
IsDebuggerPresent.KERNEL32 ref: 02BD227E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02BD2297
UnhandledExceptionFilter.KERNEL32(?), ref: 02BD22A1

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 944760e7f2de8e497d4517051bf08a67f14ecc61004f8cfc7ad2360d77554471
Instruction ID: 885eb797bd880cc7e1908d9ff3f037641e9bb6b6bdb7e13b2c96ff5bd10da32c
Opcode Fuzzy Hash: 944760e7f2de8e497d4517051bf08a67f14ecc61004f8cfc7ad2360d77554471
Instruction Fuzzy Hash: 0D31F975D052189BDF20DF64D9897CDBBB8FF08300F1041EAE80DAB240EB719A858F45

Function 02C06963 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 02BFF302: GetLastError.KERNEL32(?,?,02C05D2C,02C2A818,0000000C,02C0A365,00000000,?,02BF966D,00000000,00000000,00000000,00000000,?,?,?), ref: 02BFF306
Part of subcall function 02BFF302: SetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,?,?,02C09138,?,02C08C40,00000000,?,00000000,02C08C40), ref: 02BFF3A8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02C069B7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02C06A01
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02C06AC7

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 07423a638dea961562e192d1d56fcf9cf69cfadd15ade31f3b23811ade65dd10
Instruction ID: 1143d8ec82e5d39f58018276de1a419413da33d13d596a84ac64a22ef83773d8
Opcode Fuzzy Hash: 07423a638dea961562e192d1d56fcf9cf69cfadd15ade31f3b23811ade65dd10
Instruction Fuzzy Hash: EE6163715502179FDB24AF25CCC1BAA77ADEF44304F2081A9D906C61C4E774EAA5DB60

Function 02BFF6A6 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 02BFF79E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 02BFF7A8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 02BFF7B5

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ac6d6b49f6b5359898edb7c381472954c29c63a1d13c2b92d5f07c40288ccff7
Instruction ID: 34db486724e30fa3f15b4e76bbb07b11dce93a9427456094fc6b6b4d1cf5dfc4
Opcode Fuzzy Hash: ac6d6b49f6b5359898edb7c381472954c29c63a1d13c2b92d5f07c40288ccff7
Instruction Fuzzy Hash: EF31C774D41228ABCB61DF24D9897DCB7B4FF08310F5046DAE50CA7290EB709B858F44

Function 0322F769 Relevance: 3.3, Strings: 2, Instructions: 800COMMON

Download Yara Rule

Strings

P(, xrefs: 0322F799
2d, xrefs: 0322F7A7

Memory Dump Source

Source File: 00000000.00000002.4198744411.00000000030D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_Aura.jbxd

Similarity

API ID:
String ID: 2d$P(
API String ID: 0-922858389
Opcode ID: 992f08189d0e8994fbc4e007d8f936bfd28dd1767db4d31037ea3e6158472c97
Instruction ID: 0ab7337d2df58a24bbf6d0f5c3e54c1e9f1eb85734b82cdf013a84c548984cd8
Opcode Fuzzy Hash: 992f08189d0e8994fbc4e007d8f936bfd28dd1767db4d31037ea3e6158472c97
Instruction Fuzzy Hash: 459246B4D11619AFCB08CFA9D9959EEBBB2FF88304F24816AD415BB304D7386A41CF54

Function 02BD10B0 Relevance: 3.0, APIs: 2, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 02BD10BC
RtlAllocateHeap.NTDLL(02C2CA7C,?,?), ref: 02BD10D6

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 31995febb853ef48b02075a9b07f3466ee80b4ac11f7812e88889ba2cca72747
Instruction ID: 72713fcf0de6214f10a892b1b1e293d6b12be1be259a985e7da922782173a96e
Opcode Fuzzy Hash: 31995febb853ef48b02075a9b07f3466ee80b4ac11f7812e88889ba2cca72747
Instruction Fuzzy Hash: DED0177A890908EFD710DFA8E444B5D37E8F74E204F028A06F61D82600CB3095388F90

Function 02C173EC Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,02C173E7,?,?,00000008,?,?,02C13B50,00000000), ref: 02C17619

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 1c2ca294dbe57cd4cdd43a8edc8fa7b8f5da3779b3c95b47f875c785bf646231
Instruction ID: 1068eda429354e51db529cf37843ce1fca1e359f0c5cc244e4ac56bf3744a792
Opcode Fuzzy Hash: 1c2ca294dbe57cd4cdd43a8edc8fa7b8f5da3779b3c95b47f875c785bf646231
Instruction Fuzzy Hash: 50B14E31510609DFD715CF2CC48AB64BBE0FF46368F258698E89ACF2A1C335EA95DB40

Function 02BD2689 Relevance: 1.7, APIs: 1, Instructions: 242COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 02BD269F

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 0a154504c8fa96414c91c86b755f62402d03860f8ec56e3f3e904362c630a7ac
Instruction ID: 766b98daad0401ba3fe387644d08895d8d2e34ed9db84085e8c179d165d1235b
Opcode Fuzzy Hash: 0a154504c8fa96414c91c86b755f62402d03860f8ec56e3f3e904362c630a7ac
Instruction Fuzzy Hash: B2A1BE72D607418FDB28CF58D48179DBBB1FB48318F16866AD905E7241E7389A58CFD0

Function 02BF51FC Relevance: 1.6, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

0, xrefs: 02BF539C

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: b53d47f0204cfc103b95a5067522361f2413de0e2f8d6a3e1bad5fed7db53018
Instruction ID: f9c7b003318ddaee7c26755097c054d9579f29fff1d1ad6f158865cb9cab2316
Opcode Fuzzy Hash: b53d47f0204cfc103b95a5067522361f2413de0e2f8d6a3e1bad5fed7db53018
Instruction Fuzzy Hash: AFD1FF74A006068FCBB4CF68C484B7EB7F2FF45314F94869DD6969B291D730A94ACB50

Function 02BF55FF Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

0, xrefs: 02BF5790

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: ad203dfe155a5448c90b9677c3cd6554d4ba48aebff7b7d04d7062e873b9cce9
Instruction ID: eff0e5bb64ee1960781447d7dd8b3f93f16fa5f7b0e2f0118f9de21ad19b3c2a
Opcode Fuzzy Hash: ad203dfe155a5448c90b9677c3cd6554d4ba48aebff7b7d04d7062e873b9cce9
Instruction Fuzzy Hash: 4BD1CF74A00606DFCBB8CF68C484A6EB7F1FF44318F948699D7669B690D730A949CF50

Function 02BF4E08 Relevance: 1.6, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

0, xrefs: 02BF4F99

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 6f7afd7aada09468e1eda25d6b9ec48f5e0bcf6dfcd11de35a0e3fab66f97160
Instruction ID: 1f5db05ae71f2b095a81b91398c233498f727c890aa2951288c3b308d05b4091
Opcode Fuzzy Hash: 6f7afd7aada09468e1eda25d6b9ec48f5e0bcf6dfcd11de35a0e3fab66f97160
Instruction Fuzzy Hash: 69D1AE30A006068FCBB8CF68C584A6BB7B1FF45318F55469DD75A9B690D730AA8ACB50

Function 03243439 Relevance: 1.6, Strings: 1, Instructions: 342COMMON

Download Yara Rule

Strings

_I, xrefs: 03243462

Memory Dump Source

Source File: 00000000.00000002.4198744411.00000000030D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_Aura.jbxd

Similarity

API ID:
String ID: _I
API String ID: 0-3349887086
Opcode ID: acce168d14894613b9d9174a1472a1ec99c19a3a187001f6b8f94f35c3df8a4a
Instruction ID: 99790fba00a4acaecfe1c3e7fa108a7eeaae111d353004e2d2cc48c2567fa6a3
Opcode Fuzzy Hash: acce168d14894613b9d9174a1472a1ec99c19a3a187001f6b8f94f35c3df8a4a
Instruction Fuzzy Hash: 500288B4D112199FCB08CF98D985AEEBBB1FF88304F24816AD515BB304D7786A91CB54

Function 02BF3D12 Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

0, xrefs: 02BF3E91

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d5a77919566b0b439d0c23568d53ce5fd56f9d36693d02631bf2d91c82f49963
Instruction ID: 5f84364223f7db2037778cd18cce396d02d022fb059f79d79f2d3113c6c58ba7
Opcode Fuzzy Hash: d5a77919566b0b439d0c23568d53ce5fd56f9d36693d02631bf2d91c82f49963
Instruction Fuzzy Hash: 18C1E1359006868FCBA4CF38C58467ABBF2EF45308F0446D9E752976A1D331E98DCB61

Function 02BF4080 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 02BF41F0

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 185f03f0fef698da4187451675d121ffbc970d4b22c1c439f089313b8940ea05
Instruction ID: c17dcfb719e3e5642bee55ba7bd63b9c27cfff8f3012f9e2468e9619f0fa919e
Opcode Fuzzy Hash: 185f03f0fef698da4187451675d121ffbc970d4b22c1c439f089313b8940ea05
Instruction Fuzzy Hash: 8AC1D3709007068FCBA4CF68C58467BBBB2FF45318F0446A9D792A7691D730EA8DCB50

Function 02C06BB6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 02BFF302: GetLastError.KERNEL32(?,?,02C05D2C,02C2A818,0000000C,02C0A365,00000000,?,02BF966D,00000000,00000000,00000000,00000000,?,?,?), ref: 02BFF306
Part of subcall function 02BFF302: SetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,?,?,02C09138,?,02C08C40,00000000,?,00000000,02C08C40), ref: 02BFF3A8

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 02C06C0A

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 1c877c0e59d123583d6349eff5ba5c1b48d38ed795d2a87c7228d23290f0bc64
Instruction ID: ce9d0e4a1f7f7b9394735b41d58a4da74daee84781dc1b0d79d9b2260c0d802b
Opcode Fuzzy Hash: 1c877c0e59d123583d6349eff5ba5c1b48d38ed795d2a87c7228d23290f0bc64
Instruction Fuzzy Hash: D9219272610606ABDB289F65DC81FBA77ACEF45318B20417AED02C61C0EB74EA54DB50

Function 02BF39B3 Relevance: 1.6, Strings: 1, Instructions: 333COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 02BF3B23

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 74ad830288a6c344ab1b4817c89fbcd12e971006b8b4c8038f83493a03e87d37
Instruction ID: 827e9905fce9e66c74fed61e7e4290d70fe240b1857e200afa614c9c763071db
Opcode Fuzzy Hash: 74ad830288a6c344ab1b4817c89fbcd12e971006b8b4c8038f83493a03e87d37
Instruction Fuzzy Hash: 0FC1DC746007CA8FCBA4CE69C5A467EBBF1FF05308F0446D9DAA297691C731A98DCB50

Function 02BF473D Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

0, xrefs: 02BF48E0

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0f904b7b0ffe9b446c9e6773dbf6a67af60d3a6f5f69abb9257b8b81ef1a0520
Instruction ID: c94a01b43d982f644c7fb6f8cb7e83b77545e2d69fe32e71e5d07a7de0f9ee54
Opcode Fuzzy Hash: 0f904b7b0ffe9b446c9e6773dbf6a67af60d3a6f5f69abb9257b8b81ef1a0520
Instruction Fuzzy Hash: 4AB1C070A0064A9BCBA4CFA8C584ABFB7F5FF45308F044A99D75697690D730A94DCB50

Function 02BF43DF Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

0, xrefs: 02BF4573

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f7b6c6ecb30bdc43b05c871b37020782d5c99156464b811da9216fb2dd1efdc7
Instruction ID: ef0b9ec8d48fbac2fdce76246e848c16f184f3501a485dd6d0b1874b1a49d823
Opcode Fuzzy Hash: f7b6c6ecb30bdc43b05c871b37020782d5c99156464b811da9216fb2dd1efdc7
Instruction Fuzzy Hash: 2EB1C030A0060A9BCBA4DF68C594ABFB7F1EF44314F084699D796A7690DB31AA4DCB50

Function 02BF4AAA Relevance: 1.6, Strings: 1, Instructions: 328COMMON

Download Yara Rule

Strings

0, xrefs: 02BF4C3E

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0090561b604dea0fff3df3ebd76d71978271bd9f5b6e9ed4551ea89b069f8866
Instruction ID: 702d39552ced21748d514e7653b8493f522fb41904e2e8135ce7b29e8e38c8fd
Opcode Fuzzy Hash: 0090561b604dea0fff3df3ebd76d71978271bd9f5b6e9ed4551ea89b069f8866
Instruction Fuzzy Hash: D3B1D239A0060A8BCBA4CF68C994BBFB7F1EF44318F04459DD756A7652D730A94ECB60

Function 02BF3320 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

0, xrefs: 02BF34B3

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 48cb26964f72b3b97a43a60cfad79df1823d54a270df05950d543b9ad61b9bf4
Instruction ID: 099a661ddfd93c0e8c9ab8891179accd6bf7774cfc08b5c3f89ab41339518bd6
Opcode Fuzzy Hash: 48cb26964f72b3b97a43a60cfad79df1823d54a270df05950d543b9ad61b9bf4
Instruction Fuzzy Hash: BBB1F17090468A9BCBA5CE68C494ABEBBF1EF40308F0846DECB5297790CB30D64DCB51

Function 02BF3671 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 02BF37F5

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 5b033051db1c52b99680b240cf6d825db93defbdb381f30fa840ebad506cb4db
Instruction ID: 58f6bebdf6716f8bdfb3277439db9a42767928d96f6695b2ff803a1a602cae69
Opcode Fuzzy Hash: 5b033051db1c52b99680b240cf6d825db93defbdb381f30fa840ebad506cb4db
Instruction Fuzzy Hash: A8B1F2B090468A8BCBA8CF68C554ABEBBE1EF00308F1446D9DB9397790C735A64DCB51

Function 02BF2FDE Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 02BF3162

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: d9ba2d5f7536d4d68e0ad64ddd30dc4a58f495a33c174da1d491ad6c990c0e92
Instruction ID: 7e356f7c246b5179e7b8fe97625a73f5058b147b81e7108d216282197d9ed17b
Opcode Fuzzy Hash: d9ba2d5f7536d4d68e0ad64ddd30dc4a58f495a33c174da1d491ad6c990c0e92
Instruction Fuzzy Hash: 06B1A470A0068A8BCBA4CF78C9547BEBBE1EF45308F1446DED79297B90CB319649CB51

Function 02C0683D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 02BFF302: GetLastError.KERNEL32(?,?,02C05D2C,02C2A818,0000000C,02C0A365,00000000,?,02BF966D,00000000,00000000,00000000,00000000,?,?,?), ref: 02BFF306
Part of subcall function 02BFF302: SetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,?,?,02C09138,?,02C08C40,00000000,?,00000000,02C08C40), ref: 02BFF3A8

EnumSystemLocalesW.KERNEL32(02C06963,00000001), ref: 02C068AF

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 66f17ec2d7aa6bf221f3b8b67bc351fc623d154d1b4e835f8812a876ccab4ca4
Instruction ID: 91868d48b6858103d688f584865e70dd213e3d0ee66629f1df56d8414f0b8f80
Opcode Fuzzy Hash: 66f17ec2d7aa6bf221f3b8b67bc351fc623d154d1b4e835f8812a876ccab4ca4
Instruction Fuzzy Hash: B51129366047019FEB189F38C8D167AB796FF80328B24452CD98747A80D371A552CB40

Function 02C06DE5 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 02BFF302: GetLastError.KERNEL32(?,?,02C05D2C,02C2A818,0000000C,02C0A365,00000000,?,02BF966D,00000000,00000000,00000000,00000000,?,?,?), ref: 02BFF306
Part of subcall function 02BFF302: SetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,?,?,02C09138,?,02C08C40,00000000,?,00000000,02C08C40), ref: 02BFF3A8

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,02C06B7F,00000000,00000000,?), ref: 02C06E11

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 53128821d2dcd418b970f4c6f94308196c70d7548ef122a74741d29618ccaff7
Instruction ID: 179c81e6dd7c1bdacf9644ac4f7fe43c882ba8151cd0693e941f75806cd32184
Opcode Fuzzy Hash: 53128821d2dcd418b970f4c6f94308196c70d7548ef122a74741d29618ccaff7
Instruction Fuzzy Hash: 5201F932A00252BBDF185F35C886BBB3B5DEB80B58F254429DD26A71C0EB74FE51C694

Function 02C068D8 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 02BFF302: GetLastError.KERNEL32(?,?,02C05D2C,02C2A818,0000000C,02C0A365,00000000,?,02BF966D,00000000,00000000,00000000,00000000,?,?,?), ref: 02BFF306
Part of subcall function 02BFF302: SetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,?,?,02C09138,?,02C08C40,00000000,?,00000000,02C08C40), ref: 02BFF3A8

EnumSystemLocalesW.KERNEL32(02C06BB6,00000001), ref: 02C06922

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 77744397b7da12fc08d271dca3b230a55454cbe770a763cf7293443b38346ba0
Instruction ID: f8bdcbdcfb382e892f8576fecb9e7fd16b0f3363ed23c477bffc2221179cdd45
Opcode Fuzzy Hash: 77744397b7da12fc08d271dca3b230a55454cbe770a763cf7293443b38346ba0
Instruction Fuzzy Hash: 37F046722003041FDB186F38C8C1A7A7B99FF80328B28442CEA828BAC0D7B19942DB50

Function 02C070BE Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 02C02CDE: RtlEnterCriticalSection.NTDLL(-00019CDB), ref: 02C02CED

EnumSystemLocalesW.KERNEL32(02C070AB,00000001,02C2A838,0000000C,02C07A15,?), ref: 02C070F6

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 7c5a7cfa176789def6af8b6108387ea7f50d5635e3bfb64c0f051e2268388fdc
Instruction ID: b242b7e79c16a867e967edb862e7075d52d8d9fdaef4c2d382cf4ec65665d0b6
Opcode Fuzzy Hash: 7c5a7cfa176789def6af8b6108387ea7f50d5635e3bfb64c0f051e2268388fdc
Instruction Fuzzy Hash: 29F0AF32A44300DFEB14EF68E941B9C77F1EB04324F10422AE801DB2C0CB749909CF80

Function 02C067D4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 02BFF302: GetLastError.KERNEL32(?,?,02C05D2C,02C2A818,0000000C,02C0A365,00000000,?,02BF966D,00000000,00000000,00000000,00000000,?,?,?), ref: 02BFF306
Part of subcall function 02BFF302: SetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,?,?,02C09138,?,02C08C40,00000000,?,00000000,02C08C40), ref: 02BFF3A8

EnumSystemLocalesW.KERNEL32(02C0672D,00000001), ref: 02C0680B

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a664b1a740373413554a036a386f1663947f5a31398e0abc88f1560b63b2ff76
Instruction ID: fe71514f3f70aa90ab0a9fcd2942eb215fc151614f6a5655dbf06d66a668f919
Opcode Fuzzy Hash: a664b1a740373413554a036a386f1663947f5a31398e0abc88f1560b63b2ff76
Instruction Fuzzy Hash: 7AF0AB3A30020557CB14AF39D88577ABF98FFC1724B164058EF068B280C775E943CB50

Function 02C07BA4 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,02BE0A8B,?,20001004,00000000,00000002,?,?,02BDFDEE), ref: 02C07BD8

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: a8e8e9da71ffa772a9135042fb2aa51819431e1243fc6e876ece24ba4a89ad91
Instruction ID: da3aa58e242c69cbdae42074c768c3406075e5cdcd40f0336b2347a7e31cfe74
Opcode Fuzzy Hash: a8e8e9da71ffa772a9135042fb2aa51819431e1243fc6e876ece24ba4a89ad91
Instruction Fuzzy Hash: 7FE04F3194015CBBCF162F61DC49F9EBF16EF45760F108420FC0665290DB359D31AAD5

Function 02C0725D Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(Function_000360AB,00000001), ref: 02C07277

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 155fbaf0ff85356e3824b54966f1e7de86d39c73420261694cc711f3b43bfda6
Instruction ID: de1aba8530c67d29745f266c1a1e06ea1dc2015aabd8fbbffa3e8b1c5bda4b16
Opcode Fuzzy Hash: 155fbaf0ff85356e3824b54966f1e7de86d39c73420261694cc711f3b43bfda6
Instruction Fuzzy Hash: DCD0C77199C7046BDB246F61E886F157B65E794724B110616F40A46380DEB2A865DA80

Function 02BD2336 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001345,02BD1AFE), ref: 02BD233B

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 98482c436a1cb267e7495365175a0b7629127b4c605dc16f6ac1495502b7c846
Instruction ID: 4ee97b4acfd30c8fed0669b0962c0f5cb3de68b4bdb8339854fb5fc5216b73b2
Opcode Fuzzy Hash: 98482c436a1cb267e7495365175a0b7629127b4c605dc16f6ac1495502b7c846
Instruction Fuzzy Hash:

Function 02C11060 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de48ee1349c268fae240558c628b4fd052ae507b213508fc3d5893cd4ea2de36
Instruction ID: 1ab2fb8e87f5ee795cb5194142ba44c6923ba702145afd21f336e085bdea4018
Opcode Fuzzy Hash: de48ee1349c268fae240558c628b4fd052ae507b213508fc3d5893cd4ea2de36
Instruction Fuzzy Hash: A5F19D71A002288FDB25DF08C881BAAB3B9EF86704F1941DADA4DA7341D7749F81DF81

Function 02BFD62E Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66015ac5584c966a28adf6623fec8479daa8075245f9251e2ea36b11832dccb
Instruction ID: eb74cc44dd4950fdc62e8885803053a5df4389e7a59bb82c1bcaf627cdcb94d4
Opcode Fuzzy Hash: c66015ac5584c966a28adf6623fec8479daa8075245f9251e2ea36b11832dccb
Instruction Fuzzy Hash: 30B10120D6AF414DD363A6398832336B68CBFBB2D5F52DB1BFC2674D56EB2181938140

Function 02C10C10 Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 430999a96a78ad916b64029db012cae0049a5a4dae0df93d0fb36f34c21b1e1e
Instruction ID: 9b82423b13a17f2bbd4d54b6d53cdb99da6d829267cff1d3b0766774a13f5558
Opcode Fuzzy Hash: 430999a96a78ad916b64029db012cae0049a5a4dae0df93d0fb36f34c21b1e1e
Instruction Fuzzy Hash: 53A15A71A002698BDB24DF19C882BEDB7B5FF8A304F1541EADD49A7241D731AE85DF80

Function 030D0225 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4198744411.00000000030D0000.00000020.00001000.00020000.00000000.sdmp, Offset: 030D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_30d0000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3a5f3111a928dca1ba856e3d5f62225d449739881fc9106a5ec32747a82cb43
Instruction ID: 262dfc934eb00ffe8e96d52b77ef1751ab8aed819c71305d73f1230ebb7d5683
Opcode Fuzzy Hash: c3a5f3111a928dca1ba856e3d5f62225d449739881fc9106a5ec32747a82cb43
Instruction Fuzzy Hash: D211B675E02209EFCB44CF98C590AAEBBF5EF88300F208599D919AB344D735AA45CB90

Function 02BD745C Relevance: 19.8, APIs: 13, Instructions: 332
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 02BD7525
DName::operator+.LIBCMT ref: 02BD7562
DName::DName.LIBVCRUNTIME ref: 02BD7576
DName::operator+.LIBCMT ref: 02BD7585
DName::operator+.LIBCMT ref: 02BD7613
DName::DName.LIBVCRUNTIME ref: 02BD763B
DName::operator+.LIBCMT ref: 02BD7649
DName::operator+.LIBCMT ref: 02BD7683
DName::operator+.LIBCMT ref: 02BD76C4
UnDecorator::getReturnType.LIBCMT ref: 02BD76F4
operator+.LIBVCRUNTIME ref: 02BD77F6

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name::operator+$NameName::$Decorator::getReturnTypeoperator+
String ID:
API String ID: 2932655852-0
Opcode ID: 9c7987ee09f14100b23f3dbd8d6d1895059bff6dbfa7d1f2390294c1b26cd79a
Instruction ID: 574068621e3501f199460c0ea088c81ffd873e1cbc0e75399795ecf27ec737a5
Opcode Fuzzy Hash: 9c7987ee09f14100b23f3dbd8d6d1895059bff6dbfa7d1f2390294c1b26cd79a
Instruction Fuzzy Hash: 92C16F75D10209AFCB14DFA8D895AEDBBB9EF08304F1445AAE502A7280FF74AA45DF50

Function 02BD8A54 Relevance: 19.8, APIs: 13, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 02BD8ABF
DName::operator+.LIBCMT ref: 02BD8C02

Part of subcall function 02BD44B2: shared_ptr.LIBCMT ref: 02BD44CE

DName::operator+.LIBCMT ref: 02BD8BAD
DName::operator+.LIBCMT ref: 02BD8C4E
DName::operator+.LIBCMT ref: 02BD8C5D
DName::operator+.LIBCMT ref: 02BD8D89
DName::operator=.LIBVCRUNTIME ref: 02BD8DC9
DName::DName.LIBVCRUNTIME ref: 02BD8DD3
DName::operator+.LIBCMT ref: 02BD8DF0
DName::operator+.LIBCMT ref: 02BD8DFC

Part of subcall function 02BDA319: Replicator::operator[].LIBCMT ref: 02BDA356

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]shared_ptr
String ID:
API String ID: 1043660730-0
Opcode ID: a6771b567a5648520ae0f7645a1da5d3154eb7dc16d60602ee21ca247ccc81fa
Instruction ID: 77c694faff2fdac6d4233aada8c6eefdde8c79aa50407b38dcfa005930c2c77d
Opcode Fuzzy Hash: a6771b567a5648520ae0f7645a1da5d3154eb7dc16d60602ee21ca247ccc81fa
Instruction Fuzzy Hash: C3C190B19012489FDB24DFA8D844BEEBBF5EF15305F0844ADE146A7280FB75A689CF50

Function 02BFC75A Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 487COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 02BFCB32

Strings

p, xrefs: 02BFC8B9
f, xrefs: 02BFC86C
p, xrefs: 02BFC873
f, xrefs: 02BFC8B2
:, xrefs: 02BFC825
f, xrefs: 02BFC850
p, xrefs: 02BFC857

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: __aulldiv
String ID: :$f$f$f$p$p$p
API String ID: 3732870572-1434680307
Opcode ID: 31ee61f48bdb35299a73ee678c23193379848700d185eaefe87927cceb22a595
Instruction ID: 60680df675d7db6e373790a45465a1b7ca7a30caa5d7543ef95c2a20fde9e102
Opcode Fuzzy Hash: 31ee61f48bdb35299a73ee678c23193379848700d185eaefe87927cceb22a595
Instruction Fuzzy Hash: 94026D7990021C9ADBA4EFA4C4487EDBF72FF40B18F60959AD615AB294D3309ECCCB54

Function 02BDA319 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 185
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Replicator::operator[].LIBCMT ref: 02BDA356

Strings

@, xrefs: 02BDA4C2

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Replicator::operator[]
String ID: @
API String ID: 3676697650-2766056989
Opcode ID: 1988569939b4e60e65348b2019396e29232932f1169d1a35a2bfdcd4f9edefa2
Instruction ID: a7fb76df45f081510ea3186b7a0577c86fe971953e4c0a9512b487a085b854a7
Opcode Fuzzy Hash: 1988569939b4e60e65348b2019396e29232932f1169d1a35a2bfdcd4f9edefa2
Instruction Fuzzy Hash: CA61E871D002499FDB24DF94D455BEEBBB9EF08310F1944AAD611A3281FB78A649CF90

Function 02C0A4E6 Relevance: 10.8, APIs: 7, Instructions: 329
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strrchr.LIBCMT ref: 02C0A56C

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: e3fae6663a6cdfd9f41c54c219b0f4de7f068a42514f7783c8a721069d00455f
Instruction ID: 5216dbd47fe9f24f654a4ae62cfc9f3fa8c2f49328f30bc3dd1bba542c843815
Opcode Fuzzy Hash: e3fae6663a6cdfd9f41c54c219b0f4de7f068a42514f7783c8a721069d00455f
Instruction Fuzzy Hash: 2DB13772A00355AFDB158F68CCD1BAE7BB5EF99310F148255EA04AB3C1D374EA41CBA0

Function 02BDBC7B Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

type_info::operator==.LIBVCRUNTIME ref: 02BDBD9A
___TypeMatch.LIBVCRUNTIME ref: 02BDBEA8
CallUnexpected.LIBVCRUNTIME ref: 02BDC015

Strings

csm, xrefs: 02BDBCB8
csm, xrefs: 02BDBD25
csm, xrefs: 02BDBDD1

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 1206542248-393685449
Opcode ID: fe4e0c15be2ec0bf61bcc6eee42d7854836e30e1ef1cff78a62484a158eb62bc
Instruction ID: 8183dc8297cfe1a5c57166cbd7f9f4517000626954f1343ea85438daac1a0bed
Opcode Fuzzy Hash: fe4e0c15be2ec0bf61bcc6eee42d7854836e30e1ef1cff78a62484a158eb62bc
Instruction Fuzzy Hash: 8CB13D75800209DFCF19DFA4C980AEEBBB6FF04318B1545EAE8156B211E731EA51CF95

Function 02BD597B Relevance: 10.7, APIs: 7, Instructions: 151
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 02BD5A09
DName::operator+.LIBCMT ref: 02BD5A5C

Part of subcall function 02BD44B2: shared_ptr.LIBCMT ref: 02BD44CE

Part of subcall function 02BD43A1: DName::operator+.LIBCMT ref: 02BD43C2

DName::operator+.LIBCMT ref: 02BD5A4D
DName::operator+.LIBCMT ref: 02BD5AAD
DName::operator+.LIBCMT ref: 02BD5ABA
DName::operator+.LIBCMT ref: 02BD5B01
DName::operator+.LIBCMT ref: 02BD5B0E

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name::operator+$shared_ptr
String ID:
API String ID: 1037112749-0
Opcode ID: 744be0fdf5a58bcab96be4694fa38de3ce237b53e486148323b78feb8360b25f
Instruction ID: 2d32122302ffcff61a1da970145a01b42bd5f666d123a7fe6a628cbf7a97fe0b
Opcode Fuzzy Hash: 744be0fdf5a58bcab96be4694fa38de3ce237b53e486148323b78feb8360b25f
Instruction Fuzzy Hash: BB5154B1D00218ABDF25DB94D895EEEBBB9EF08710F44419AE515A7180FF74A648CFA0

Function 02C155DC Relevance: 9.3, APIs: 6, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86a8cbb0e2acca0a5b894b76fc0f4bf3321ca26658525bcc07e17ea0179ae9eb
Instruction ID: a1a6dde56f4bf12073ca7832e38e554d6a4de284b7b0f3f4027a1629907ced7c
Opcode Fuzzy Hash: 86a8cbb0e2acca0a5b894b76fc0f4bf3321ca26658525bcc07e17ea0179ae9eb
Instruction Fuzzy Hash: 3AB12570E44245AFEB21DF98C882BBD7BB1AFCB354F444198E505AB2C1C7709A46DFA0

Function 02BDA1C5 Relevance: 9.1, APIs: 6, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DName::operator+.LIBCMT ref: 02BDA209
DName::operator+.LIBCMT ref: 02BDA215

Part of subcall function 02BD44B2: shared_ptr.LIBCMT ref: 02BD44CE

DName::operator+=.LIBCMT ref: 02BDA2D3

Part of subcall function 02BD8A54: DName::operator+.LIBCMT ref: 02BD8ABF
Part of subcall function 02BD8A54: DName::operator+.LIBCMT ref: 02BD8D89

Part of subcall function 02BD43A1: DName::operator+.LIBCMT ref: 02BD43C2

DName::operator+.LIBCMT ref: 02BDA290

Part of subcall function 02BD450A: DName::operator=.LIBVCRUNTIME ref: 02BD452B

DName::DName.LIBVCRUNTIME ref: 02BDA2F7
DName::operator+.LIBCMT ref: 02BDA303

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator+=Name::operator=shared_ptr
String ID:
API String ID: 2795783184-0
Opcode ID: 4e153eb8420c6818405ef8fb30b0c394c338ad23af5f50d4840aa2dc73f0b168
Instruction ID: 359b19cab4aaaa9889bc4ad5529683eb0d14acf702aabc539178192c6d878cb3
Opcode Fuzzy Hash: 4e153eb8420c6818405ef8fb30b0c394c338ad23af5f50d4840aa2dc73f0b168
Instruction Fuzzy Hash: 1A41E8B1A002449FDB24DFA8C454BDE7BFAEF09304F5444D9D196D7280FB796A84CB54

Function 02BD8E12 Relevance: 9.1, APIs: 6, Instructions: 94
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02BDA319: Replicator::operator[].LIBCMT ref: 02BDA356

DName::operator=.LIBVCRUNTIME ref: 02BD8EBE

Part of subcall function 02BD8A54: DName::operator+.LIBCMT ref: 02BD8ABF
Part of subcall function 02BD8A54: DName::operator+.LIBCMT ref: 02BD8D89

DName::operator+.LIBCMT ref: 02BD8E78
DName::operator+.LIBCMT ref: 02BD8E84
DName::DName.LIBVCRUNTIME ref: 02BD8EC8
DName::operator+.LIBCMT ref: 02BD8EE5
DName::operator+.LIBCMT ref: 02BD8EF1

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=Replicator::operator[]
String ID:
API String ID: 955152517-0
Opcode ID: 67da7d499f9de4530bd7a761a0f5117fef92969ae48060364e49cbe9da43ceee
Instruction ID: 544a346642b829585598da15b36d43736f6d8ad154bf7edf650f22b5ccdafa88
Opcode Fuzzy Hash: 67da7d499f9de4530bd7a761a0f5117fef92969ae48060364e49cbe9da43ceee
Instruction Fuzzy Hash: F631B3B1A002049FCB24DF68D554AEEBBF6EF49304F1488ADD586A7350FB74A544CF50

Function 02BD3864 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,02BD385B,02BD3330,02BD2389), ref: 02BD3872
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 02BD3880
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 02BD3899
SetLastError.KERNEL32(00000000,02BD385B,02BD3330,02BD2389), ref: 02BD38EB

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 39ab7192f89e74253eb785ec18c90c61382bd8219638cc7a87a689fe5aa9df41
Instruction ID: e6a29debbd96624d319e857055e9c014454d8650c1f51207868b2ff0e9782dd6
Opcode Fuzzy Hash: 39ab7192f89e74253eb785ec18c90c61382bd8219638cc7a87a689fe5aa9df41
Instruction Fuzzy Hash: 220124726E83115EA7242678BC84B9E2B95FB0177872103FAE018910D1FF135C159BC2

Function 02C0119F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Aura.exe, xrefs: 02C011BB

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID:
String ID: C:\Users\user\Desktop\Aura.exe
API String ID: 0-3946295530
Opcode ID: 033848be707d9853f0258769f9a39f7a3a00a9f157ea83ad6a39fa56df0cfdd9
Instruction ID: 1a78487b190580b186faebbc3f8c7ece5d90f04b436af4d78551a081a882570d
Opcode Fuzzy Hash: 033848be707d9853f0258769f9a39f7a3a00a9f157ea83ad6a39fa56df0cfdd9
Instruction Fuzzy Hash: B6218171600205AFDB10AFA5CCC0E6BF7AAAF893647184519EA2DD75D0E7B0ED10CFA0

Function 02C0E1E4 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(02C2C080,00000000,00000000,?), ref: 02C0E247

Part of subcall function 02C021C3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,02C08C40,00000000,02C0EC36,?,00000000,?,?,?,02C0E90C,0000FDE9,00000000,?), ref: 02C02224

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 02C0E499
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 02C0E4DF
GetLastError.KERNEL32 ref: 02C0E582

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 6032640b9d6f12b679e14643717b71605bcbd669d8c8e4b7c0397eccc500645b
Instruction ID: 274d3cad87ebcaf93370719247a677ed376685c450ab28ab4cf1785e3f7c0829
Opcode Fuzzy Hash: 6032640b9d6f12b679e14643717b71605bcbd669d8c8e4b7c0397eccc500645b
Instruction Fuzzy Hash: 14D179B5D402589FCB14CFA8D8C0AADBBB5FF49304F18496AE456EB391E730A946CF50

Function 02BD6AA2 Relevance: 6.2, APIs: 4, Instructions: 192COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 02BD6AA9
UnDecorator::getSymbolName.LIBCMT ref: 02BD6B3B
DName::operator+.LIBCMT ref: 02BD6C3F
DName::DName.LIBVCRUNTIME ref: 02BD6CE2

Part of subcall function 02BD44B2: shared_ptr.LIBCMT ref: 02BD44CE

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name$Decorator::getH_prolog3Name::Name::operator+Symbolshared_ptr
String ID:
API String ID: 334624791-0
Opcode ID: 0e6e23714a79ddfd171b75ef62d9f90002db8a1d32519d35deb6abcc585e5fe6
Instruction ID: e04c8b6319543fd526d56208af97f286e867f6f2c42426f8a58f158425e59715
Opcode Fuzzy Hash: 0e6e23714a79ddfd171b75ef62d9f90002db8a1d32519d35deb6abcc585e5fe6
Instruction Fuzzy Hash: E5718FB1D102498FDB24CF94E481BEEBBB9FF08314F09059AD511BB241EB75AA45CF90

Function 02BD7131 Relevance: 6.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 02BD7265

Part of subcall function 02BD4101: __aulldvrm.LIBCMT ref: 02BD4132

DName::operator+.LIBCMT ref: 02BD71C6
DName::operator=.LIBVCRUNTIME ref: 02BD72AA
DName::DName.LIBVCRUNTIME ref: 02BD72DC

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name::operator+$NameName::Name::operator=__aulldvrm
String ID:
API String ID: 2973644308-0
Opcode ID: f2125b5748592f2eb4331f44fbd6d45b0d8b57b599994c6d2c30315b600b9adf
Instruction ID: 77f47ac3ed2cd46f3e38f25f5e41bc42ac89ef29c46a4ecde22ec3b76287dce2
Opcode Fuzzy Hash: f2125b5748592f2eb4331f44fbd6d45b0d8b57b599994c6d2c30315b600b9adf
Instruction Fuzzy Hash: 0A619D71D10295DFCB24CF58D880BEDBBB1FF46304F05859AE851AB240EBB09A81DF90

Function 02BDBA24 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 02BDBAEB
___AdjustPointer.LIBCMT ref: 02BDBB0E
___AdjustPointer.LIBCMT ref: 02BDBBAA

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1f8d7bcfaf326d8e5ca9ef499b8468df96bc0de2baa64f9deb807b82e353d8cb
Instruction ID: ef20485e67ff79407f495bb2c993416e1bfb0301446b180a43aeddee11f222e7
Opcode Fuzzy Hash: 1f8d7bcfaf326d8e5ca9ef499b8468df96bc0de2baa64f9deb807b82e353d8cb
Instruction Fuzzy Hash: 4F51E2726047029FDB298F14C880BFAB7A6FF00718F1645ADED5647295FB31E881CB90

Function 02BD6E62 Relevance: 6.1, APIs: 4, Instructions: 131COMMON

Download Yara Rule

APIs

DName::operator+.LIBCMT ref: 02BD6E95

Part of subcall function 02BD4476: DName::operator+=.LIBCMT ref: 02BD448C

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name::operator+Name::operator+=
String ID:
API String ID: 382699925-0
Opcode ID: 2b46f8a08eb0beb1b9af3799d8a0eadea13e2d122ce716fe7ce48c283c8501d2
Instruction ID: 72741955ff30307777dacfc9642e6c2f91c501a0fd1f331406b14f68f0842a24
Opcode Fuzzy Hash: 2b46f8a08eb0beb1b9af3799d8a0eadea13e2d122ce716fe7ce48c283c8501d2
Instruction Fuzzy Hash: 30413BB1D0020ADBCF14DFA8E585AEEBBB9EF04314F00459AE505A7240EB75DB88DF91

Function 02C000C4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 02C021C3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,02C08C40,00000000,02C0EC36,?,00000000,?,?,?,02C0E90C,0000FDE9,00000000,?), ref: 02C02224

GetLastError.KERNEL32 ref: 02C00128
__dosmaperr.LIBCMT ref: 02C0012F
GetLastError.KERNEL32(?,?,?,?), ref: 02C00169
__dosmaperr.LIBCMT ref: 02C00170

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 4cb0d657b772d865c6124ac9dfeace093b7604212d045676c508ef36b6c982cb
Instruction ID: d17d348e1c3a0d1a76f2812daf81e4a16df8d5f537a7487ed94588807049d7c7
Opcode Fuzzy Hash: 4cb0d657b772d865c6124ac9dfeace093b7604212d045676c508ef36b6c982cb
Instruction Fuzzy Hash: 88216571600609BFDB20AF65CCC0B6BB7AAFF443647028519E969976D0E731EE51CBA0

Function 02C022CA Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 02C022D2

Part of subcall function 02C021C3: WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,02C08C40,00000000,02C0EC36,?,00000000,?,?,?,02C0E90C,0000FDE9,00000000,?), ref: 02C02224

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02C0230A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 02C0232A

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 09616acf0bf2ecc8c611d520a40b0278e3e4ddaccc4cb4ad0052ef18b4e1b3a3
Instruction ID: 53f3479775bed1ea7f2aafd0a10fb84d9ad3e8261c134ced6d51a8c9d0d90a83
Opcode Fuzzy Hash: 09616acf0bf2ecc8c611d520a40b0278e3e4ddaccc4cb4ad0052ef18b4e1b3a3
Instruction Fuzzy Hash: 1E1122F29026167EA71127B25CCDCBF6A5DEECA2A87000565FE0AD11C0EB64CF0189B2

Function 02C0761D Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,?,?,02C2C080,?,02C0772C,02C17729,02BFFEAB,00000000,?), ref: 02C076DE

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ab69802b8ee42f997a5ee255865c9e3a6f2999d486bd39122d1c11e1160f34bd
Instruction ID: f802933f3db6aee3e5bb510ecde41e1159099ef269e746e8529868647d24e4df
Opcode Fuzzy Hash: ab69802b8ee42f997a5ee255865c9e3a6f2999d486bd39122d1c11e1160f34bd
Instruction Fuzzy Hash: D5213075E40111ABD7255B68DCC1B5AB7589B42764F250651ED07A72C0DB30FA19CAF0

Function 02C14C2B Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?), ref: 02C14C41
GetLastError.KERNEL32(?,?,?,?), ref: 02C14C4E
SetFilePointerEx.KERNEL32(?,?,?,?,?), ref: 02C14C74
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 02C14C9A

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: FilePointer$ErrorLast
String ID:
API String ID: 142388799-0
Opcode ID: ec4b2ccd388cab2ce0c632283e049f510f5521de67faaa5e92c2e31a5d244de9
Instruction ID: 0180d6c41b92d77e3537af94c255fbf5fdcf8220a2be0d9e6d8237fed81b0ae2
Opcode Fuzzy Hash: ec4b2ccd388cab2ce0c632283e049f510f5521de67faaa5e92c2e31a5d244de9
Instruction Fuzzy Hash: F3115771900129BBCF249FA5CD49ADE3F7AFF867A0F104644F826961A0D731CA50EBA0

Function 02C17A8F Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 02C17AA9
GetLastError.KERNEL32 ref: 02C17AB5

Part of subcall function 02C17B5E: CloseHandle.KERNEL32(02C2C950,02C17BA8,?,02C14F61,00000000,00000001,00000000,?,?,02C0E5D6,?,00000000,00000000,?,?), ref: 02C17B6E

___initconout.LIBCMT ref: 02C17AC5

Part of subcall function 02C17B20: CreateFileW.KERNEL32(02C28DBC,40000000,00000003,00000000,00000003,00000000,00000000,02C17B4F,02C14F4E,?,?,02C0E5D6,?,00000000,00000000,?), ref: 02C17B33

WriteConsoleW.KERNEL32(?,?,?,00000000), ref: 02C17AD9

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 7fcd5cd2021ca94f0a0964382a2b0d66209c8d690e23ca46cde1c73a7f9b8452
Instruction ID: ea133ad6185e340fd06f7107654582d6afd9a22b8ab65d4af3278f04a715d4fc
Opcode Fuzzy Hash: 7fcd5cd2021ca94f0a0964382a2b0d66209c8d690e23ca46cde1c73a7f9b8452
Instruction Fuzzy Hash: FAF08236580100BBCB222B96DC05F4ABFA7FFCE3617214815F94A82120CB32E564EF90

Function 02C17B75 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,02C14F61,00000000,00000001,00000000,?,?,02C0E5D6,?,00000000,00000000), ref: 02C17B8C
GetLastError.KERNEL32(?,02C14F61,00000000,00000001,00000000,?,?,02C0E5D6,?,00000000,00000000,?,?,?,02C0EBC1,00000000), ref: 02C17B98

Part of subcall function 02C17B5E: CloseHandle.KERNEL32(02C2C950,02C17BA8,?,02C14F61,00000000,00000001,00000000,?,?,02C0E5D6,?,00000000,00000000,?,?), ref: 02C17B6E

___initconout.LIBCMT ref: 02C17BA8

Part of subcall function 02C17B20: CreateFileW.KERNEL32(02C28DBC,40000000,00000003,00000000,00000003,00000000,00000000,02C17B4F,02C14F4E,?,?,02C0E5D6,?,00000000,00000000,?), ref: 02C17B33

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,02C14F61,00000000,00000001,00000000,?,?,02C0E5D6,?,00000000,00000000,?), ref: 02C17BBD

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: f99ccd72ff55cd07586d39ca3e966ec10e02255cd0f68fd39363937d6884729b
Instruction ID: 5df42ea18c2b3263de1e3299625a2820c02ac8908456f9a0abfae86c4d72b6a8
Opcode Fuzzy Hash: f99ccd72ff55cd07586d39ca3e966ec10e02255cd0f68fd39363937d6884729b
Instruction Fuzzy Hash: B8F01C36841115BBCF222FA1DC05B8D7F26FF4A3B1B218511FE1995120CB328934EBD0

Function 02BFC492 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 02BFC609

Strings

-, xrefs: 02BFC55A
+, xrefs: 02BFC567

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 4b7f0084c6dd7cc236bf80f2e254111bd822154ec7f7a1d93f11596916ab6f32
Instruction ID: c82122fea8767a109a2679b5d9fc6a2bb41226fec717a3b32525b38abb291d3b
Opcode Fuzzy Hash: 4b7f0084c6dd7cc236bf80f2e254111bd822154ec7f7a1d93f11596916ab6f32
Instruction Fuzzy Hash: 54A1AE70E4424CAFCFA4CE7888517AE7FA1EF46324F04959BEA65AB281D330D589CB50

Function 02BD2D30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 02BD2D6F
__IsNonwritableInCurrentImage.LIBCMT ref: 02BD2E23

Strings

csm, xrefs: 02BD2E0D

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 9978cee5e546398f9fec3984e4128facb1bccc8fb21785d83c2bcd186a108e11
Instruction ID: 5709022d3e9d6386632b0385fe8bd5bdee7b47c8c07e551fcb24cb9e9a8324a5
Opcode Fuzzy Hash: 9978cee5e546398f9fec3984e4128facb1bccc8fb21785d83c2bcd186a108e11
Instruction Fuzzy Hash: C7418234A002999BCF14DF68C884ADEBBB5FF45328F1481D6EC159B352EB319A15CF91

Function 02BDC020 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 02BDC045

Strings

RCC, xrefs: 02BDC05F
MOC, xrefs: 02BDC057

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 703aa69d3d6cc8e9d9ace1e0aa39ee82cb2a848e1127efec1add896f1758b36c
Instruction ID: 3dc3ea5b1efb0a41badee4a0929b851171e76f3b9eb8a1b41503e5c35cdd1038
Opcode Fuzzy Hash: 703aa69d3d6cc8e9d9ace1e0aa39ee82cb2a848e1127efec1add896f1758b36c
Instruction Fuzzy Hash: B9415B71900219AFCF15DF98CC81AEEBBB5FF48304F15819AF90567211E335A991DF54

Function 02BD3061 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

___unDName.LIBVCRUNTIME ref: 02BD308E

Part of subcall function 02BDA85F: ___unDNameEx.LIBVCRUNTIME ref: 02BDA878

RtlInterlockedPushEntrySList.NTDLL(?,?), ref: 02BD3109

Strings

Y, xrefs: 02BD307C

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: Name___un$EntryInterlockedListPush
String ID: Y
API String ID: 723550680-2843332214
Opcode ID: f16aa1737ee2731ff88781e75123df76d242c2e1f2c6ff80b9366f355b80c351
Instruction ID: f1325261965400a064b3839a291cd3a2bb95e29745c2a4a4f0d3c00885920060
Opcode Fuzzy Hash: f16aa1737ee2731ff88781e75123df76d242c2e1f2c6ff80b9366f355b80c351
Instruction Fuzzy Hash: DA210771900205AFDB11DF68DC81AEA7BEAEF45618B2440E8E8069B202F7369D45CF92

Function 02BD7399 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

DName::DName.LIBVCRUNTIME ref: 02BD73B0
DName::DName.LIBVCRUNTIME ref: 02BD7435

Strings

A, xrefs: 02BD7415

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: NameName::
String ID: A
API String ID: 1333004437-3554254475
Opcode ID: 84daa25e9e09342d4b20dd75b252f88e54f53ec6e3dda5bb28b913cca8af7c16
Instruction ID: 7fca86d398e3cc805959a0e45b91dd3c9aad34dba57ed0953fe39ee1c8ebde1d
Opcode Fuzzy Hash: 84daa25e9e09342d4b20dd75b252f88e54f53ec6e3dda5bb28b913cca8af7c16
Instruction Fuzzy Hash: 6421AC71900148AFCF21DF64C841BECBBB2EF04318F0884D9E8159B250EBB1AA86DF41

Function 02BD3E2D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 02BD3E4A

Part of subcall function 02BDA94E: _vsnprintf.LEGACY_STDIO_DEFINITIONS ref: 02BDA95E

swprintf.LIBCMT ref: 02BD3E6D

Part of subcall function 02BDA968: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 02BDA97A

Strings

%lf, xrefs: 02BD3E40, 02BD3E45, 02BD3E6A

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ___swprintf_l__vswprintf_c_l_vsnprintfswprintf
String ID: %lf
API String ID: 3672277462-2891890143
Opcode ID: c042cce5d5b8b35cd3fd3272f8c927533767df4160091193927348bbc152694d
Instruction ID: 159cd27d3fe1d0cb04ec49a1d82348c81509b0bf7a48974cfe736d76ec5f1d0b
Opcode Fuzzy Hash: c042cce5d5b8b35cd3fd3272f8c927533767df4160091193927348bbc152694d
Instruction Fuzzy Hash: 2CF0CDB2500008BADB00AB85CC49FFF7F6DDF85664F1240C8F68526241EB799E00A7B6

Function 02BD3E8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 02BD3EA6

Part of subcall function 02BDA94E: _vsnprintf.LEGACY_STDIO_DEFINITIONS ref: 02BDA95E

swprintf.LIBCMT ref: 02BD3EC9

Part of subcall function 02BDA968: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 02BDA97A

Strings

%lf, xrefs: 02BD3E9C, 02BD3EA1, 02BD3EC6

Memory Dump Source

Source File: 00000000.00000002.4198655852.0000000002BD1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02BD1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2bd1000_Aura.jbxd

Similarity

API ID: ___swprintf_l__vswprintf_c_l_vsnprintfswprintf
String ID: %lf
API String ID: 3672277462-2891890143
Opcode ID: 4c2ce2fc40a0e142290f615dd255bdd2c2f2afc439dd888a69cef5da9c4ddd98
Instruction ID: 7d9dc5fe044fc520403fc1bc16c9bee33f1fa3ffbcb50d51e348036e703a3186
Opcode Fuzzy Hash: 4c2ce2fc40a0e142290f615dd255bdd2c2f2afc439dd888a69cef5da9c4ddd98
Instruction Fuzzy Hash: D3F0B4B2100008BADB00AB55CC45FFF7B6DDF49764F1280C8FA4917241EB799E0497B5

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Aura.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

UDP Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: Aura.exePID: 7576, Parent PID: 2580

General

Chronological Activities

Analysis Process: conhost.exePID: 7592, Parent PID: 7576

General

Chronological Activities

Disassembly

Analysis Process: Aura.exePID: 7576, Parent PID: 2580COMMON

Execution Graph

Graph

Windows Analysis Report
Aura.exe

Function 00615FC0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 341
windowCOMMON

Function 030D0445 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 196
memoryCOMMON

Function 02BD1B0B Relevance: 7.6, APIs: 5, Instructions: 119
COMMON

Function 02BD745C Relevance: 19.8, APIs: 13, Instructions: 332
COMMONLIBRARYCODE

Function 02BD8A54 Relevance: 19.8, APIs: 13, Instructions: 305
COMMONLIBRARYCODE

Function 02BDA319 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 185
COMMONLIBRARYCODE

Function 02C0A4E6 Relevance: 10.8, APIs: 7, Instructions: 329
COMMONLIBRARYCODE

Function 02BDBC7B Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Function 02BD597B Relevance: 10.7, APIs: 7, Instructions: 151
COMMONLIBRARYCODE

Function 02C155DC Relevance: 9.3, APIs: 6, Instructions: 292
COMMON

Function 02BDA1C5 Relevance: 9.1, APIs: 6, Instructions: 119
COMMON

Function 02BD8E12 Relevance: 9.1, APIs: 6, Instructions: 94
COMMONLIBRARYCODE