Analysis

  • max time kernel
    599s
  • max time network
    607s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/01/2023, 17:23

General

  • Target

    Python_Installer/Python_Launcher.exe

  • Size

    680.1MB

  • MD5

    ed7c41cd8998c25583d99fb81d1969c1

  • SHA1

    b3b8922108351583f78d4210429bec2759cd03ea

  • SHA256

    1626ffa2f441e7d85c1de5a59979eb5c2732f126918813a92de6e5d81b1ce3ed

  • SHA512

    384889f6fa2c0f1fa5605aa241dee6dbfbb23893e008668b514a671cedd38e1a0953f67c9b293312ca6d6cbe4372ddb4893367f832ea7b619cea3b6625cb023c

  • SSDEEP

    49152:sv21srHHBlsTmcTR/IlhudZcJiWxZhpOgKsXuXdUG66ykRqsjfj:RWrHhlEXTR/MKZbMZhpOWup6/gj

Malware Config

Extracted

Family

aurora

C2

79.137.206.138:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Python_Installer\Python_Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Python_Installer\Python_Launcher.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:952
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA3AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3964
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2200
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4808
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
        3⤵
        • Executes dropped EXE
        PID:4220

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    1KB

    MD5

    6195a91754effb4df74dbc72cdf4f7a6

    SHA1

    aba262f5726c6d77659fe0d3195e36a85046b427

    SHA256

    3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5

    SHA512

    ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

    Filesize

    53KB

    MD5

    06ad34f9739c5159b4d92d702545bd49

    SHA1

    9152a0d4f153f3f40f7e606be75f81b582ee0c17

    SHA256

    474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

    SHA512

    c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    16KB

    MD5

    ac3ad4ad47f85e3a95919ee24659a31a

    SHA1

    f30d6d945a5367419abea40bc9c2f79279b26234

    SHA256

    49c6d777967bb3424a6302ce176534cb7e6091ac42108e615a0ae1e69def2bfa

    SHA512

    5b32bc4f35c0abd913551bfbc96fa08d69e067826530fc902b624accb88af3c0efa752364ecb813a5cbf9e06c0e77f38bfa17e3407305bfafac83d3344d98512

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe

    Filesize

    364.9MB

    MD5

    b8f4d297ca8d6fd0c502d13477a0c02a

    SHA1

    08ac6d6451698354f9204a2ac80751e7572f0e0e

    SHA256

    62ee6a526bf001a942c8af9c4afb3b4ec243b1d566fd0b83c950dcdf02ff836d

    SHA512

    497633af662c117eadb373ce055a72b91412ee861355321a63ea14712b34c56752c4ecfd423ee3705d02288f14f9fcfb11243876dd5335852d8ea4009ffef1b1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe

    Filesize

    364.9MB

    MD5

    b8f4d297ca8d6fd0c502d13477a0c02a

    SHA1

    08ac6d6451698354f9204a2ac80751e7572f0e0e

    SHA256

    62ee6a526bf001a942c8af9c4afb3b4ec243b1d566fd0b83c950dcdf02ff836d

    SHA512

    497633af662c117eadb373ce055a72b91412ee861355321a63ea14712b34c56752c4ecfd423ee3705d02288f14f9fcfb11243876dd5335852d8ea4009ffef1b1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe

    Filesize

    364.9MB

    MD5

    b8f4d297ca8d6fd0c502d13477a0c02a

    SHA1

    08ac6d6451698354f9204a2ac80751e7572f0e0e

    SHA256

    62ee6a526bf001a942c8af9c4afb3b4ec243b1d566fd0b83c950dcdf02ff836d

    SHA512

    497633af662c117eadb373ce055a72b91412ee861355321a63ea14712b34c56752c4ecfd423ee3705d02288f14f9fcfb11243876dd5335852d8ea4009ffef1b1

  • memory/1248-135-0x0000000000C40000-0x0000000000EC8000-memory.dmp

    Filesize

    2.5MB

  • memory/1248-139-0x0000000008690000-0x00000000086B2000-memory.dmp

    Filesize

    136KB

  • memory/1248-138-0x0000000005930000-0x000000000593A000-memory.dmp

    Filesize

    40KB

  • memory/1248-137-0x0000000005860000-0x00000000058F2000-memory.dmp

    Filesize

    584KB

  • memory/1248-136-0x0000000005ED0000-0x0000000006474000-memory.dmp

    Filesize

    5.6MB

  • memory/3964-143-0x0000000005EB0000-0x0000000005F16000-memory.dmp

    Filesize

    408KB

  • memory/3964-147-0x0000000006A60000-0x0000000006A7A000-memory.dmp

    Filesize

    104KB

  • memory/3964-145-0x0000000006590000-0x00000000065AE000-memory.dmp

    Filesize

    120KB

  • memory/3964-141-0x0000000004F90000-0x0000000004FC6000-memory.dmp

    Filesize

    216KB

  • memory/3964-144-0x0000000005F90000-0x0000000005FF6000-memory.dmp

    Filesize

    408KB

  • memory/3964-146-0x0000000007BE0000-0x000000000825A000-memory.dmp

    Filesize

    6.5MB

  • memory/3964-142-0x0000000005620000-0x0000000005C48000-memory.dmp

    Filesize

    6.2MB

  • memory/4220-157-0x0000000000400000-0x0000000000876000-memory.dmp

    Filesize

    4.5MB

  • memory/4220-164-0x0000000000400000-0x0000000000876000-memory.dmp

    Filesize

    4.5MB

  • memory/4220-152-0x0000000000400000-0x0000000000876000-memory.dmp

    Filesize

    4.5MB

  • memory/4220-155-0x0000000000400000-0x0000000000876000-memory.dmp

    Filesize

    4.5MB

  • memory/4808-160-0x0000000070DD0000-0x0000000070E1C000-memory.dmp

    Filesize

    304KB

  • memory/4808-161-0x0000000006FC0000-0x0000000006FDE000-memory.dmp

    Filesize

    120KB

  • memory/4808-162-0x0000000007400000-0x000000000740A000-memory.dmp

    Filesize

    40KB

  • memory/4808-163-0x00000000075F0000-0x0000000007686000-memory.dmp

    Filesize

    600KB

  • memory/4808-159-0x0000000007000000-0x0000000007032000-memory.dmp

    Filesize

    200KB

  • memory/4808-165-0x0000000005E90000-0x0000000005E9E000-memory.dmp

    Filesize

    56KB

  • memory/4808-166-0x00000000075B0000-0x00000000075CA000-memory.dmp

    Filesize

    104KB

  • memory/4808-167-0x0000000007590000-0x0000000007598000-memory.dmp

    Filesize

    32KB