aurora | 1aa500d0e87c1ecb35553db91c8b96029ff89feb1a4c0fb06b6c0238700d83b6

Analysis

max time kernel
140s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/02/2023, 14:22

Target

Setup.exe
Size

17.5MB
MD5

8be316ace6f4c4d501fc27cbe2558871
SHA1

c4a2cd32b90a4d3fca1328cc10dc0d9996d9dded
SHA256

1aa500d0e87c1ecb35553db91c8b96029ff89feb1a4c0fb06b6c0238700d83b6
SHA512

9153b1dc081ad891b15f163ffe570a0b02ce5ef18828c537f94cfcd61e1d7b8ac448bcaa4257b64428c901c9494934e0bca7d825d0c689dad1badce7325c896c
SSDEEP

49152:mwXXV7ULoZ67ys/Twlsqjw1fbVrhVugEpwPxGkYyLw7y1wV+nFy7rNIznFCyT5jU:moFU1f1SgnGXd7y1wVmFdT5c

Score

10^/10

aurora stealer upx

Family

aurora

5.75.144.249:8081

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral1/memory/744-58-0x0000000001470000-0x00000000018F6000-memory.dmp	upx
behavioral1/memory/744-60-0x0000000001470000-0x00000000018F6000-memory.dmp	upx
behavioral1/memory/744-63-0x0000000001470000-0x00000000018F6000-memory.dmp	upx
behavioral1/memory/744-64-0x0000000001470000-0x00000000018F6000-memory.dmp	upx
behavioral1/memory/744-66-0x0000000001470000-0x00000000018F6000-memory.dmp	upx
behavioral1/memory/744-67-0x0000000001470000-0x00000000018F6000-memory.dmp	upx
behavioral1/memory/744-68-0x0000000001470000-0x00000000018F6000-memory.dmp	upx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 744	1516	Setup.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	Setup.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26
PID 1516 wrote to memory of 744	1516	Setup.exe	26

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  PID:744

memory/744-61-0x0000000000400000-0x0000000000886000-memory.dmp

Filesize
4.5MB

Download
memory/744-57-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/744-58-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/744-60-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/744-63-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/744-64-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/744-66-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/744-67-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/744-68-0x0000000001470000-0x00000000018F6000-memory.dmp

Filesize
4.5MB

Download
memory/1516-55-0x0000000000160000-0x00000000012F0000-memory.dmp

Filesize
17.6MB

Download
memory/1516-56-0x0000000001E30000-0x0000000001E4C000-memory.dmp

Filesize
112KB

Download
memory/1516-54-0x0000000075451000-0x0000000075453000-memory.dmp

Filesize
8KB

Download