aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
130s
max time network
156s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 01:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora purecrypter downloader loader persistence stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Detect PureCrypter injector 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1340-66-0x0000000006520000-0x00000000068C0000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Executes dropped EXE 2 IoCs

pid	Process
1352	voiceadequovl.exe
1340	voiceadequovl.exe

Loads dropped DLL 4 IoCs

pid	Process
1352	voiceadequovl.exe
1352	voiceadequovl.exe
1352	voiceadequovl.exe
1352	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1340 set thread context of 1736	1340	voiceadequovl.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
524	powershell.exe
1680	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	voiceadequovl.exe
Token: SeDebugPrivilege	524	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1352	1228	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1228 wrote to memory of 1352	1228	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1228 wrote to memory of 1352	1228	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1228 wrote to memory of 1352	1228	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1352 wrote to memory of 1340	1352	voiceadequovl.exe	29
PID 1352 wrote to memory of 1340	1352	voiceadequovl.exe	29
PID 1352 wrote to memory of 1340	1352	voiceadequovl.exe	29
PID 1352 wrote to memory of 1340	1352	voiceadequovl.exe	29
PID 1340 wrote to memory of 524	1340	voiceadequovl.exe	30
PID 1340 wrote to memory of 524	1340	voiceadequovl.exe	30
PID 1340 wrote to memory of 524	1340	voiceadequovl.exe	30
PID 1340 wrote to memory of 524	1340	voiceadequovl.exe	30
PID 1340 wrote to memory of 868	1340	voiceadequovl.exe	32
PID 1340 wrote to memory of 868	1340	voiceadequovl.exe	32
PID 1340 wrote to memory of 868	1340	voiceadequovl.exe	32
PID 1340 wrote to memory of 868	1340	voiceadequovl.exe	32
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 868 wrote to memory of 1680	868	cmd.exe	35
PID 868 wrote to memory of 1680	868	cmd.exe	35
PID 868 wrote to memory of 1680	868	cmd.exe	35
PID 868 wrote to memory of 1680	868	cmd.exe	35
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34
PID 1340 wrote to memory of 1736	1340	voiceadequovl.exe	34

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
    "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1340
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:524
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
  - - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      4⤵
      PID:1736
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic os get Caption
        5⤵
        
        PID:536
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic path win32_VideoController get name"
        5⤵
        
        PID:1400
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        
        PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic cpu get name"
        5⤵
        
        PID:1012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
3c0d506ed47513cf1034c8182c0c0abc

SHA1
d27245516dfac35ca278c64fa1101dbb7d4ad1f9

SHA256
b981c77b2f39e27f24653b2194288d8f779e1dcfbc9585114bb99dc0c94b5f0c

SHA512
c9678e10be0aea543c74ad8ff76eba0e9a722e11e079f65e65133b934ba38827e69494c8d2959ad9d57c3e9faea01663679e86441e9d6ab6e18f4ba961d00cb3

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
259.9MB

MD5
a033480d74158d5c22a7e69f067f2cee

SHA1
522a5f352816c00b1e221dce48ec2b527ff2c576

SHA256
d595e7d830f161145ed539b065b26222462319baa9af3a4929a4931d7a04f061

SHA512
a9eaee63e9abf70db1e42ef348238513b358ea0dc06b013d668b5c5e36629bfed6228ed01f3d57491d31bfb92fc85e844d128f1176520204cbc20c4091feaf40

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
247.4MB

MD5
2ff286222db0a8a5ffbb63a56e2ceccf

SHA1
938fb8d3dd5e505e1a9465a47444578074ccd228

SHA256
ace78bb96af6b738c20f9dcfd0f4b55ac468086af31e2460782183f6355e74a5

SHA512
b37a20edd8e4e7a03f8f1e89116749a63fa9cf32151057460654b1b8ea32091cc35ba9522b5f91e3413195c1c91bb1fb9973416de39830ca2dc4662b27e83f5c

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
45.4MB

MD5
5624b3f33a72b64eb6e25d977e8305c1

SHA1
1ed657d6e49148473da820789c468e2cc404b498

SHA256
8b275ab296ab8405472ed11fb6130a0b65290a9bb9c7b2532c23e3accb5c593d

SHA512
58e1c34e58d142c930bac8b5b7cbc7ae6eb142d051e0b9aaf4193e5465d358e0d1cf7ebbeafb65ab18ab3b1030de08860269190e4c1c37a567e43505ee399acc

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
269.2MB

MD5
bc2759be812c0bf82fa0412be9701b66

SHA1
921c6d5c7cd9bbd8b2c25e3efcc253d2ec2761e2

SHA256
6c750163f517f7bcb806e3dc494ce7693935f7594311619b9e400aaf6794c027

SHA512
15450444164b64e1a8de16d1c89c4980325fefe3db671b17b9d8525fca520fc8f9b22a7dcdf3822a929348080e5596a793b48e1aaa3d497c8dceb99b7846b08a

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
266.9MB

MD5
466e1db958a494314d39befc5d5963c7

SHA1
8a30a1f7d766f2c886a06ed1d0185eafe9774326

SHA256
90d2f0ccd27c792166c1f7058ab621d60de127f0be0fbf55aa24cc7015723dad

SHA512
348b574988eb977b35360ce96de04aaff228d7047e52666ba9a384c7912d1515c3d85c179f29df194c86377893a3fdf2ef859ddd5b9b9d4ec7dad972be1c4ca4

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
261.4MB

MD5
5693479504dda2603967653b265d8ed6

SHA1
328d56a5c0956488654caf3ddd725776c485f58a

SHA256
7c6a7d637d88eb646eeb090062e627cc2427eb797e0e5f7dc9f08fc6411094cd

SHA512
b7eaa948212bcb82c7b100b1e59be95cd024056390eff28d4ce39f771b81ab1b42eda7f928ffbdfc3665be7d48ea30e69eaac5aa125bd9b50af01a7e46d2cef7

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
267.9MB

MD5
175a3dfdc5afc57f5c103017fb4014b1

SHA1
bd6cd1e6df8bd5fa4f20021f98abbead905f3b76

SHA256
9f3e00f6e050797648cda2c10fca6f7653be1a81e00305fe446a92a9f5480084

SHA512
5f5a03440ac47179a1ebbe10c9ef0d67406c6973d209ce0363bc03416f4154b117d7da47adb69da22750aa01ba87cb209962cdce5d8be88f917dd24cefb30e0f

Download Submit
memory/524-69-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Filesize
5.7MB

Download
memory/524-70-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Filesize
5.7MB

Download
memory/524-71-0x000000006F7F0000-0x000000006FD9B000-memory.dmp

Filesize
5.7MB

Download
memory/1340-66-0x0000000006520000-0x00000000068C0000-memory.dmp

Filesize
3.6MB

Download
memory/1340-65-0x0000000001100000-0x0000000001874000-memory.dmp

Filesize
7.5MB

Download
memory/1340-73-0x0000000005520000-0x0000000005692000-memory.dmp

Filesize
1.4MB

Download
memory/1352-56-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1680-93-0x000000006F540000-0x000000006FAEB000-memory.dmp

Filesize
5.7MB

Download
memory/1736-80-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-88-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-92-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-87-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-94-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-84-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-82-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-74-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-76-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1736-78-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download