aurora | 22913f02fbd3267035e5a3b80d2e6fcf22e076096daa2f8ca615fee30d341554

Analysis

max time kernel
102s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2023, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
rufus-3.21.exe
Size 3.0MB
Sample230113-3nvglaeh89
SHA256 22913f02fbd3267035e5a3b80d2e6fcf22e076096daa2f8ca615fee30d341554
MD5 b3f2cf1a2735f28070606cbf781958a0
SHA1 bdc5a47584b4b26b05691dffab369af4f6faaa6d
SHA512 ba4a9412268d53c4d5b4a4cb84479e204b231b8c056cf75bc9180c2ad4fd7c4ad1d0b1176348ea512b38cd7cc050273208095ba984eb2a9cb77d0905158b6eee
SSDEEP 49152:3cgsqBYHlRErOc/7NC0ojUe92k+fjc4z/Ibh6:PsEYFerjpdIU/44zQbh6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora persistence stealer

Malware Config

Extracted

Family

aurora

79.137.206.138:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Executes dropped EXE 5 IoCs

pid	Process
1388	socialprov.exe
1436	socialprov.exe
4972	socialprov.exe
1152	socialprov.exe
3452	socialprov.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	socialprov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	rufus-3.21.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	rufus-3.21.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 3452	1388	socialprov.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3504	powershell.exe
3504	powershell.exe
1388	socialprov.exe
1388	socialprov.exe
1388	socialprov.exe
1388	socialprov.exe
3908	powershell.exe
1388	socialprov.exe
1388	socialprov.exe
3908	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	3504	powershell.exe
Token: SeDebugPrivilege	1388	socialprov.exe
Token: SeDebugPrivilege	3908	powershell.exe
Token: SeIncreaseQuotaPrivilege	2496	wmic.exe
Token: SeSecurityPrivilege	2496	wmic.exe
Token: SeTakeOwnershipPrivilege	2496	wmic.exe
Token: SeLoadDriverPrivilege	2496	wmic.exe
Token: SeSystemProfilePrivilege	2496	wmic.exe
Token: SeSystemtimePrivilege	2496	wmic.exe
Token: SeProfSingleProcessPrivilege	2496	wmic.exe
Token: SeIncBasePriorityPrivilege	2496	wmic.exe
Token: SeCreatePagefilePrivilege	2496	wmic.exe
Token: SeBackupPrivilege	2496	wmic.exe
Token: SeRestorePrivilege	2496	wmic.exe
Token: SeShutdownPrivilege	2496	wmic.exe
Token: SeDebugPrivilege	2496	wmic.exe
Token: SeSystemEnvironmentPrivilege	2496	wmic.exe
Token: SeRemoteShutdownPrivilege	2496	wmic.exe
Token: SeUndockPrivilege	2496	wmic.exe
Token: SeManageVolumePrivilege	2496	wmic.exe
Token: 33	2496	wmic.exe
Token: 34	2496	wmic.exe
Token: 35	2496	wmic.exe
Token: 36	2496	wmic.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1388	5000	rufus-3.21.exe	82
PID 5000 wrote to memory of 1388	5000	rufus-3.21.exe	82
PID 5000 wrote to memory of 1388	5000	rufus-3.21.exe	82
PID 1388 wrote to memory of 3504	1388	socialprov.exe	89
PID 1388 wrote to memory of 3504	1388	socialprov.exe	89
PID 1388 wrote to memory of 3504	1388	socialprov.exe	89
PID 1388 wrote to memory of 4272	1388	socialprov.exe	94
PID 1388 wrote to memory of 4272	1388	socialprov.exe	94
PID 1388 wrote to memory of 4272	1388	socialprov.exe	94
PID 4272 wrote to memory of 3908	4272	cmd.exe	96
PID 4272 wrote to memory of 3908	4272	cmd.exe	96
PID 4272 wrote to memory of 3908	4272	cmd.exe	96
PID 1388 wrote to memory of 1436	1388	socialprov.exe	97
PID 1388 wrote to memory of 1436	1388	socialprov.exe	97
PID 1388 wrote to memory of 1436	1388	socialprov.exe	97
PID 1388 wrote to memory of 4972	1388	socialprov.exe	98
PID 1388 wrote to memory of 4972	1388	socialprov.exe	98
PID 1388 wrote to memory of 4972	1388	socialprov.exe	98
PID 1388 wrote to memory of 1152	1388	socialprov.exe	99
PID 1388 wrote to memory of 1152	1388	socialprov.exe	99
PID 1388 wrote to memory of 1152	1388	socialprov.exe	99
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 1388 wrote to memory of 3452	1388	socialprov.exe	100
PID 3452 wrote to memory of 2496	3452	socialprov.exe	102
PID 3452 wrote to memory of 2496	3452	socialprov.exe	102
PID 3452 wrote to memory of 2496	3452	socialprov.exe	102

C:\Users\Admin\AppData\Local\Temp\rufus-3.21.exe
"C:\Users\Admin\AppData\Local\Temp\rufus-3.21.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3908
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    3⤵
    - Executes dropped EXE
    PID:1436
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    3⤵
    - Executes dropped EXE
    PID:4972
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    3⤵
    - Executes dropped EXE
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2496
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      4⤵
      PID:4092
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        
        PID:1920
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic cpu get name"
      4⤵
      PID:1332
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic cpu get name
        5⤵
        
        PID:4248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 5af72c66d7f586e76244933427607e3cf30b9c1d155b77f88b867afe14dbab63
MD5 1eeb1d2be21d44d45e6a53d2e09be9a6
SHA1 bab9ddc9d15f5688df9a61328b5ee0baf2d7664c
SHA512 6303fc58e59e4c69fe9402a9c9a8e9569c7a733dd7fd2ddc1dc191b4328db9bee93935d5ee9a96f18e8f7ae357dcfe11219adead231f41fac9c3d8b39c64e26e
SSDEEP 384:9rf+js9i+fgsyaiK4kZo9o9m2XK6seYcIR/r03SoZ0fYSP8jq0LOu:Vf3yFSqo9m2XNb2YSDRiq0Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

socialprov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
Size 431.8MB
SHA256 62c0ca44a45e5bee69d3cc41327e1b925218af7e4d3424a66542ce5daa1962b1
MD5 39641e123df5b32144021e9ca4cd2d01
SHA1 a699042594235a89fe4ef0167f03c0d6cfc2a418
SHA512 e9c827e5c15005beb901056d85d0a32d73cba0ba714a0f49fa07a2b293acc82d553cb4eb407c24672276e9805a878dead58b7731ff9a755d3559c1f33f314bde
SSDEEP 49152:f19nuW95HHnRmJfwNTOIoosUN5gM+5aSGgoYD:XPHcJ0aVRUoRGgoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

socialprov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
Size 431.8MB
SHA256 62c0ca44a45e5bee69d3cc41327e1b925218af7e4d3424a66542ce5daa1962b1
MD5 39641e123df5b32144021e9ca4cd2d01
SHA1 a699042594235a89fe4ef0167f03c0d6cfc2a418
SHA512 e9c827e5c15005beb901056d85d0a32d73cba0ba714a0f49fa07a2b293acc82d553cb4eb407c24672276e9805a878dead58b7731ff9a755d3559c1f33f314bde
SSDEEP 49152:f19nuW95HHnRmJfwNTOIoosUN5gM+5aSGgoYD:XPHcJ0aVRUoRGgoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

socialprov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
Size 209.9MB
SHA256 7f08cdcc32f8c2a724b73293f4671e28d3376b1db09e011ea8f63ee4b21a8bc4
MD5 6009ed89f365623429cc6b2fb51d060a
SHA1 714e323e279efbdc96f026ee4041af4888236e95
SHA512 eaebcedba324024b470539f49dd23c7036d37c327ca5a62c78863c1f86bf71cbb0b3e897d653156a107859533b4a743595625b17362c32aa259e786c45739fb2
SSDEEP 49152:f19nuW95HHnRmJfwNTOIoosUN5gM+5aSGgoYD:XPHcJ0aVRUoRGgoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

socialprov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
Size 204.8MB
SHA256 d328796e19a74a2a6bcf3bc16b2a01886fa946f39a93543f28dfa427be9c19b0
MD5 692e3968a74d6fd2454c7f75ae03f22d
SHA1 9fa8db61e55434a2222126d2b40bd17a33997d5c
SHA512 483537b562b8151820f0b3df012a81770aa3fcf1320e052dd6a4e8abc327f77a2b71cdbb9fc44a0dfd9c19c71f818006f75e7b633f3a5a85c76ef6f0bb8fedf6
SSDEEP 49152:f19nuW95HHnRmJfwNTOIoosUN5gM+5aSGgoYD:XPHcJ0aVRUoRGgoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

socialprov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
Size 193.4MB
SHA256 67ef7b85a96df15d121bf9e5ac2602ebe56928d5b08fee539e8a463812282ced
MD5 7ae16950e87cc0d8ac782f3b8fd070ea
SHA1 30103d477bf8a2ebb75a8fe17dbdb431c79d3670
SHA512 8570072c2170308f58e381a1d8932f944901baf3f48f5f16ff2434d9e9a29d920d01bc3d775d0afaecfb0ed6c93b394ba913b98e8ff6ab1fea5068aaf45a138c
SSDEEP 49152:f19nuW95HHnRmJfwNTOIoosUN5gM+5aSGgoYD:XPHcJ0aVRUoRGgoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

socialprov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\socialprov.exe
Size 179.6MB
SHA256 0c70bbf48b540cc805f4eefcb54b6d8a63bdde0ad52cd02df4b65ffcebd23193
MD5 9442e8d248340e4b775b5b389e9d6eb0
SHA1 03d391c908808eca6dc06585c6bb014e665c4f0e
SHA512 26dfbee13ce88d97bf7f21c3ae0dad81250044a31e636d97fef5d1326f0b3c74f5be6a0ac3e194e6db58968fa47a01c9a1d41f0bcca15b03d09ddb71feb6a441
SSDEEP 49152:f19nuW95HHnRmJfwNTOIoosUN5gM+5aSGgoYD:XPHcJ0aVRUoRGgoM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1388-135-0x0000000000890000-0x0000000000B34000-memory.dmp

Download

memory/1388-136-0x0000000005990000-0x0000000005F34000-memory.dmp

Download

memory/1388-139-0x0000000008300000-0x0000000008322000-memory.dmp

Download

memory/1388-137-0x00000000054E0000-0x0000000005572000-memory.dmp

Download

memory/1388-138-0x0000000005590000-0x000000000559A000-memory.dmp

Download

memory/3452-158-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/3452-175-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/3452-163-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/3452-161-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/3504-142-0x00000000057E0000-0x0000000005E08000-memory.dmp

Download

memory/3504-141-0x0000000005110000-0x0000000005146000-memory.dmp

Download

memory/3504-147-0x0000000006BF0000-0x0000000006C0A000-memory.dmp

Download

memory/3504-145-0x0000000005470000-0x000000000548E000-memory.dmp

Download

memory/3504-144-0x0000000005E80000-0x0000000005EE6000-memory.dmp

Download

memory/3504-143-0x0000000005E10000-0x0000000005E76000-memory.dmp

Download

memory/3504-146-0x0000000007D60000-0x00000000083DA000-memory.dmp

Download

memory/3908-169-0x0000000073790000-0x00000000737DC000-memory.dmp

Download

memory/3908-168-0x0000000005F90000-0x0000000005FC2000-memory.dmp

Download

memory/3908-170-0x0000000005F70000-0x0000000005F8E000-memory.dmp

Download

memory/3908-172-0x0000000006BC0000-0x0000000006BCA000-memory.dmp

Download

memory/3908-174-0x00000000070B0000-0x0000000007146000-memory.dmp

Download

memory/3908-176-0x0000000006C50000-0x0000000006C5E000-memory.dmp

Download

memory/3908-177-0x0000000007030000-0x000000000704A000-memory.dmp

Download

memory/3908-178-0x0000000006FF0000-0x0000000006FF8000-memory.dmp

Download