aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
115s
max time network
154s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora purecrypter downloader loader persistence stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Detect PureCrypter injector 1 IoCs

loader

Processes:

resource	yara_rule
behavioral1/memory/652-66-0x0000000006550000-0x00000000068F0000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Executes dropped EXE 3 IoCs

Processes:

voiceadequovl.exevoiceadequovl.exevoiceadequovl.exe

pid process

1716 voiceadequovl.exe
652 voiceadequovl.exe
1628 voiceadequovl.exe
Loads dropped DLL 4 IoCs

Processes:

voiceadequovl.exe

pid process

1716 voiceadequovl.exe
1716 voiceadequovl.exe
1716 voiceadequovl.exe
1716 voiceadequovl.exe

pid	process
1716	voiceadequovl.exe
652	voiceadequovl.exe
1628	voiceadequovl.exe

pid	process
1716	voiceadequovl.exe
1716	voiceadequovl.exe
1716	voiceadequovl.exe
1716	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

voiceadequovl.exe

description pid process target process

PID 652 set thread context of 1628 652 voiceadequovl.exe voiceadequovl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1884 powershell.exe
1984 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

voiceadequovl.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 652 voiceadequovl.exe
Token: SeDebugPrivilege 1884 powershell.exe
Token: SeDebugPrivilege 1984 powershell.exe

description	pid	process	target process
PID 652 set thread context of 1628	652	voiceadequovl.exe	voiceadequovl.exe

pid	process
1884	powershell.exe
1984	powershell.exe

description	pid	process
Token: SeDebugPrivilege	652	voiceadequovl.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	1984	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exe

description	pid	process	target process
PID 1136 wrote to memory of 1716	1136	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 1136 wrote to memory of 1716	1136	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 1136 wrote to memory of 1716	1136	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 1136 wrote to memory of 1716	1136	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 1716 wrote to memory of 652	1716	voiceadequovl.exe	voiceadequovl.exe
PID 1716 wrote to memory of 652	1716	voiceadequovl.exe	voiceadequovl.exe
PID 1716 wrote to memory of 652	1716	voiceadequovl.exe	voiceadequovl.exe
PID 1716 wrote to memory of 652	1716	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1884	652	voiceadequovl.exe	powershell.exe
PID 652 wrote to memory of 1884	652	voiceadequovl.exe	powershell.exe
PID 652 wrote to memory of 1884	652	voiceadequovl.exe	powershell.exe
PID 652 wrote to memory of 1884	652	voiceadequovl.exe	powershell.exe
PID 652 wrote to memory of 392	652	voiceadequovl.exe	cmd.exe
PID 652 wrote to memory of 392	652	voiceadequovl.exe	cmd.exe
PID 652 wrote to memory of 392	652	voiceadequovl.exe	cmd.exe
PID 652 wrote to memory of 392	652	voiceadequovl.exe	cmd.exe
PID 392 wrote to memory of 1984	392	cmd.exe	powershell.exe
PID 392 wrote to memory of 1984	392	cmd.exe	powershell.exe
PID 392 wrote to memory of 1984	392	cmd.exe	powershell.exe
PID 392 wrote to memory of 1984	392	cmd.exe	powershell.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe
PID 652 wrote to memory of 1628	652	voiceadequovl.exe	voiceadequovl.exe

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1136

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
4⤵
- Suspicious use of WriteProcessMemory
PID:392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
PID:1628

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
5⤵
PID:2016

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
5⤵
PID:2040

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
PID:748

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
5⤵
PID:1368

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
6⤵
PID:1808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
953302fb248fc41b0a44a62c9d10f2f6

SHA1
8d40527ac2b17718dce1e32361d5da8eb4029eb4

SHA256
a4e946d4410b798b652ba644f61d909b7909c1c58db44b81912f3e5d4ce14695

SHA512
efe72343f5539b08def128698f3035521b7b510ca95858468b1d6b7cc1cfb6fd130e726f1abd29433c98685c5138eef3eb1b4e4027695617bdc0053c3a824318

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
229.2MB

MD5
ca9164f1dec23f3c49b68713c1071f31

SHA1
f46b6ca1d07093d4cd19520e4670fec89fe8504d

SHA256
15b3a1c428c1214dcaa86c03e2ada59cd33b84fceff1d1be485624238f8e11ed

SHA512
6f7cc6172319e10db39bc8e1584ecd8c283442e1213ad4d0bd3ae93ae58834479c1dcddb63f1e23b0caf73bfef10eb5e0e4243c950709e99b0795d9604ea0421

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
228.4MB

MD5
d08718ee789d6f1126493f8e87e7860b

SHA1
8e9daadc33a63d094941bbd6cedade6f586d020c

SHA256
275eb8807c8548adf57714341dac05f80bc02cc353d2761d4e852b87a9800036

SHA512
4ce6fea87d6526fa8c02f9082b698ba7ac7f1a7677dbf165f7656afc190bc8de13be78b3187fa506a303af6012e5f7ed571dd783125010deb76c39bb7cd6c6a5

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
74.9MB

MD5
233db0587cdb6504abf968636bf0c53f

SHA1
638ffa592a61450aa424c1d9a211b7c311a0a4af

SHA256
882274c2c6b71649127ac9df39994c85786fdc08d3fa37500c8f505ecd203323

SHA512
21c8eebf16ac9903833708acbee7b92aa2a79ab5f938bf7cc46a2ed7d4a2d75c8c1b606a919577ae7482917d2eab0f1e5ea59c1440284953d95e3ca34d66f0c3

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
221.8MB

MD5
8f00444311c997c842f787f5a48e583e

SHA1
2ea0074597330de98f1fe1750c3f6f044c4aa427

SHA256
cea806a83bda1d57081ad1f254f7d35290e522ead9d3fad5a24c5a1dd9c29e17

SHA512
dca2033b533ae1db498bd917b6090b33c75981dbef2e52affe97c2cc830205ed95b8572a5e676128b30bc45196017427b7cf3127dd1af855a3138ff04a40b230

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
227.2MB

MD5
abd6ca0d5cdb2b673dba8aea7d32937b

SHA1
f075cd29697ba0c09913279c32d86344806d72f3

SHA256
f2e4444c2851163f6f707168cb12da1306e8b130e6ef600711e9ec83947a9f62

SHA512
bea26eb0c359f46c9eec2e04f9b7f0ace6387657c7ae7e40b9350eef3128ea01aafdf57f5a563ee70f940de911ad801b45d995a5d481d5e1911105cc0d1c247f

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
227.4MB

MD5
3da72920e445a6ec7986c4c976a6ab43

SHA1
2a47b94cdf463bd1f450a5189c7cf6e86e8711bf

SHA256
ab14ee4db3a2368cd6a6265c0421c31bb0d2140ab60cacad6b6493e479b9dce2

SHA512
b73a9d479a8e29833c5c68eb6463cc28d6efd1e6f4b0f1ce179747b2665ba17f38ed8c682e7844703c6f5d148ea6757d9775d2e7993dbc108f7f92562e45231d

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
231.4MB

MD5
a801780c9439110d982d9b0f52207d65

SHA1
9701403210dc630af1773b9220593a7c47235d5d

SHA256
4d0512cc075187236daa0bfd34dfac5e04994e1e28c386e762087f86c163a37a

SHA512
b673921fd0b1fd6bbea42e526072b2b9c0fc2b2a30c6a03ff05aec042e5408646ec593e5bd8774841521045c3baedf271074358f09fa97912d53ea66acb84218

Download Submit
memory/392-72-0x0000000000000000-mapping.dmp

Download
memory/652-62-0x0000000000000000-mapping.dmp

Download
memory/652-65-0x00000000008D0000-0x0000000001044000-memory.dmp

Filesize
7.5MB

Download
memory/652-66-0x0000000006550000-0x00000000068F0000-memory.dmp

Filesize
3.6MB

Download
memory/652-73-0x0000000005530000-0x00000000056A2000-memory.dmp

Filesize
1.4MB

Download
memory/748-98-0x0000000000000000-mapping.dmp

Download
memory/1368-99-0x0000000000000000-mapping.dmp

Download
memory/1628-95-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-89-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-93-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-76-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-90-0x0000000000464C20-mapping.dmp

Download
memory/1628-78-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-101-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-80-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-83-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-86-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-85-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1628-88-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1716-54-0x0000000000000000-mapping.dmp

Download
memory/1716-56-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download
memory/1808-100-0x0000000000000000-mapping.dmp

Download
memory/1884-71-0x000000006FE10000-0x00000000703BB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-70-0x000000006FE10000-0x00000000703BB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-69-0x000000006FE10000-0x00000000703BB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-67-0x0000000000000000-mapping.dmp

Download
memory/1984-81-0x000000006FB40000-0x00000000700EB000-memory.dmp

Filesize
5.7MB

Download
memory/1984-74-0x0000000000000000-mapping.dmp

Download
memory/1984-94-0x000000006FB40000-0x00000000700EB000-memory.dmp

Filesize
5.7MB

Download
memory/2016-96-0x0000000000000000-mapping.dmp

Download
memory/2040-97-0x0000000000000000-mapping.dmp

Download