aurora | b21293d38f5b89444a9e4e4bed355346398e21b2654640496ed07077d55d60ea

Analysis

max time kernel
599s
max time network
607s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2023, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Python_Installer/Python_Launcher.exe
Size 680.1MB
Sample230123-vyevwsfh9t
SHA256 1626ffa2f441e7d85c1de5a59979eb5c2732f126918813a92de6e5d81b1ce3ed
MD5 ed7c41cd8998c25583d99fb81d1969c1
SHA1 b3b8922108351583f78d4210429bec2759cd03ea
SHA512 384889f6fa2c0f1fa5605aa241dee6dbfbb23893e008668b514a671cedd38e1a0953f67c9b293312ca6d6cbe4372ddb4893367f832ea7b619cea3b6625cb023c
SSDEEP 49152:sv21srHHBlsTmcTR/IlhudZcJiWxZhpOgKsXuXdUG66ykRqsjfj:RWrHhlEXTR/MKZbMZhpOWup6/gj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora persistence stealer

Malware Config

Extracted

Family

aurora

79.137.206.138:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Executes dropped EXE 2 IoCs

pid	Process
1248	yeahprogov.exe
4220	yeahprogov.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	yeahprogov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	Python_Launcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Python_Launcher.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1248 set thread context of 4220	1248	yeahprogov.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3964	powershell.exe
3964	powershell.exe
4808	powershell.exe
4808	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	1248	yeahprogov.exe
Token: SeDebugPrivilege	4808	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 1248	952	Python_Launcher.exe	79
PID 952 wrote to memory of 1248	952	Python_Launcher.exe	79
PID 952 wrote to memory of 1248	952	Python_Launcher.exe	79
PID 1248 wrote to memory of 3964	1248	yeahprogov.exe	87
PID 1248 wrote to memory of 3964	1248	yeahprogov.exe	87
PID 1248 wrote to memory of 3964	1248	yeahprogov.exe	87
PID 1248 wrote to memory of 2200	1248	yeahprogov.exe	91
PID 1248 wrote to memory of 2200	1248	yeahprogov.exe	91
PID 1248 wrote to memory of 2200	1248	yeahprogov.exe	91
PID 2200 wrote to memory of 4808	2200	cmd.exe	93
PID 2200 wrote to memory of 4808	2200	cmd.exe	93
PID 2200 wrote to memory of 4808	2200	cmd.exe	93
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94
PID 1248 wrote to memory of 4220	1248	yeahprogov.exe	94

C:\Users\Admin\AppData\Local\Temp\Python_Installer\Python_Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Python_Installer\Python_Launcher.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:952
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1248
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA3AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4808
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
    3⤵
    - Executes dropped EXE
    PID:4220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 49c6d777967bb3424a6302ce176534cb7e6091ac42108e615a0ae1e69def2bfa
MD5 ac3ad4ad47f85e3a95919ee24659a31a
SHA1 f30d6d945a5367419abea40bc9c2f79279b26234
SHA512 5b32bc4f35c0abd913551bfbc96fa08d69e067826530fc902b624accb88af3c0efa752364ecb813a5cbf9e06c0e77f38bfa17e3407305bfafac83d3344d98512
SSDEEP 384:Gb+jA9i+eP33fTRfx7cANo98J8TnK6seYZIR/r03SoZ4fYSPyjE0LSu:CiDNxAAO8J8TnNy+YSfRYE0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeahprogov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
Size 364.9MB
SHA256 62ee6a526bf001a942c8af9c4afb3b4ec243b1d566fd0b83c950dcdf02ff836d
MD5 b8f4d297ca8d6fd0c502d13477a0c02a
SHA1 08ac6d6451698354f9204a2ac80751e7572f0e0e
SHA512 497633af662c117eadb373ce055a72b91412ee861355321a63ea14712b34c56752c4ecfd423ee3705d02288f14f9fcfb11243876dd5335852d8ea4009ffef1b1
SSDEEP 49152:Nx87iuS+uh2+QtlqoCaHYElIdrfgjuPE5uzu8NiiRFCeigfXMGAdOfPemCR/GOO:Nw4oCaHPlWjgjucYuvkFCei/GBPhh
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeahprogov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
Size 364.9MB
SHA256 62ee6a526bf001a942c8af9c4afb3b4ec243b1d566fd0b83c950dcdf02ff836d
MD5 b8f4d297ca8d6fd0c502d13477a0c02a
SHA1 08ac6d6451698354f9204a2ac80751e7572f0e0e
SHA512 497633af662c117eadb373ce055a72b91412ee861355321a63ea14712b34c56752c4ecfd423ee3705d02288f14f9fcfb11243876dd5335852d8ea4009ffef1b1
SSDEEP 49152:Nx87iuS+uh2+QtlqoCaHYElIdrfgjuPE5uzu8NiiRFCeigfXMGAdOfPemCR/GOO:Nw4oCaHPlWjgjucYuvkFCei/GBPhh
MD5 SHA1 SHA512 SSDEEP

Submit Download

yeahprogov.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\yeahprogov.exe
Size 364.9MB
SHA256 62ee6a526bf001a942c8af9c4afb3b4ec243b1d566fd0b83c950dcdf02ff836d
MD5 b8f4d297ca8d6fd0c502d13477a0c02a
SHA1 08ac6d6451698354f9204a2ac80751e7572f0e0e
SHA512 497633af662c117eadb373ce055a72b91412ee861355321a63ea14712b34c56752c4ecfd423ee3705d02288f14f9fcfb11243876dd5335852d8ea4009ffef1b1
SSDEEP 49152:Nx87iuS+uh2+QtlqoCaHYElIdrfgjuPE5uzu8NiiRFCeigfXMGAdOfPemCR/GOO:Nw4oCaHPlWjgjucYuvkFCei/GBPhh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1248-135-0x0000000000C40000-0x0000000000EC8000-memory.dmp

Download

memory/1248-139-0x0000000008690000-0x00000000086B2000-memory.dmp

Download

memory/1248-138-0x0000000005930000-0x000000000593A000-memory.dmp

Download

memory/1248-137-0x0000000005860000-0x00000000058F2000-memory.dmp

Download

memory/1248-136-0x0000000005ED0000-0x0000000006474000-memory.dmp

Download

memory/3964-143-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Download

memory/3964-147-0x0000000006A60000-0x0000000006A7A000-memory.dmp

Download

memory/3964-145-0x0000000006590000-0x00000000065AE000-memory.dmp

Download

memory/3964-141-0x0000000004F90000-0x0000000004FC6000-memory.dmp

Download

memory/3964-144-0x0000000005F90000-0x0000000005FF6000-memory.dmp

Download

memory/3964-146-0x0000000007BE0000-0x000000000825A000-memory.dmp

Download

memory/3964-142-0x0000000005620000-0x0000000005C48000-memory.dmp

Download

memory/4220-157-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/4220-164-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/4220-152-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/4220-155-0x0000000000400000-0x0000000000876000-memory.dmp

Download

memory/4808-160-0x0000000070DD0000-0x0000000070E1C000-memory.dmp

Download

memory/4808-161-0x0000000006FC0000-0x0000000006FDE000-memory.dmp

Download

memory/4808-162-0x0000000007400000-0x000000000740A000-memory.dmp

Download

memory/4808-163-0x00000000075F0000-0x0000000007686000-memory.dmp

Download

memory/4808-159-0x0000000007000000-0x0000000007032000-memory.dmp

Download

memory/4808-165-0x0000000005E90000-0x0000000005E9E000-memory.dmp

Download

memory/4808-166-0x00000000075B0000-0x00000000075CA000-memory.dmp

Download

memory/4808-167-0x0000000007590000-0x0000000007598000-memory.dmp

Download