aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
139s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora purecrypter downloader loader persistence stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Detect PureCrypter injector 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1472-66-0x0000000006450000-0x00000000067F0000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Executes dropped EXE 3 IoCs

pid	Process
1756	voiceadequovl.exe
1472	voiceadequovl.exe
1620	voiceadequovl.exe

Loads dropped DLL 4 IoCs

pid	Process
1756	voiceadequovl.exe
1756	voiceadequovl.exe
1756	voiceadequovl.exe
1756	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1472 set thread context of 1620	1472	voiceadequovl.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
520	powershell.exe
576	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1472	voiceadequovl.exe
Token: SeDebugPrivilege	520	powershell.exe
Token: SeDebugPrivilege	576	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 1756	1016	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1016 wrote to memory of 1756	1016	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1016 wrote to memory of 1756	1016	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1016 wrote to memory of 1756	1016	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1756 wrote to memory of 1472	1756	voiceadequovl.exe	29
PID 1756 wrote to memory of 1472	1756	voiceadequovl.exe	29
PID 1756 wrote to memory of 1472	1756	voiceadequovl.exe	29
PID 1756 wrote to memory of 1472	1756	voiceadequovl.exe	29
PID 1472 wrote to memory of 520	1472	voiceadequovl.exe	30
PID 1472 wrote to memory of 520	1472	voiceadequovl.exe	30
PID 1472 wrote to memory of 520	1472	voiceadequovl.exe	30
PID 1472 wrote to memory of 520	1472	voiceadequovl.exe	30
PID 1472 wrote to memory of 1512	1472	voiceadequovl.exe	32
PID 1472 wrote to memory of 1512	1472	voiceadequovl.exe	32
PID 1472 wrote to memory of 1512	1472	voiceadequovl.exe	32
PID 1472 wrote to memory of 1512	1472	voiceadequovl.exe	32
PID 1512 wrote to memory of 576	1512	cmd.exe	34
PID 1512 wrote to memory of 576	1512	cmd.exe	34
PID 1512 wrote to memory of 576	1512	cmd.exe	34
PID 1512 wrote to memory of 576	1512	cmd.exe	34
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35
PID 1472 wrote to memory of 1620	1472	voiceadequovl.exe	35

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
    "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1512
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:576
  - - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      4⤵
      Executes dropped EXE
      PID:1620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
397b2cc0fa949d77cbbe8cda5c02896c

SHA1
851680bbb3845063963579d8c6ff1fff3d2bdb51

SHA256
915af581274e39f2dcc284a9301e5b0369a37df7fbb83b13a518b7979ecab7f5

SHA512
ea07b3675e8c450849340d22c8744938987c67a7e82945a6fcc099a63131329e132ac984d0caeb7e5a77905a7a9e3d269011b1e3cf8b7d89f35e99f811434f1c

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
234.1MB

MD5
90f117933133a32710beb76145f82035

SHA1
4b3a0c11a385a15641c446b7d83ed55ee792aa3b

SHA256
3f4f3cddaa33bb6763e1b45d5ac4c5e603fb195228bbfb14a67984719f514bc9

SHA512
fcc946abd5d7f0da28a4084b456a0dbb1a56cfeb793adcabd219b9c0c905f13740f9db81c86ed799e11b7cf8d43d03d59ede45627d83d01e86bbff191ad6d9aa

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
225.2MB

MD5
487bc63a135e91c54458e8cf4cfd9171

SHA1
e703d9d563ee87f859961af5300c880db7cecf8e

SHA256
182dbfc5a822af35df91a5406840b556380741fbed81d89a73e70faf5b51fbcc

SHA512
8996a3a716c6ebd0ec2c1fa21a1f6b75487136cd2ca2b85ba6edc1026d67e61fc150e81779fe659b1d0f3d4f95ec05995b089d088725350bc8849db9980d6bcd

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
43.1MB

MD5
be16d1dd63674aab8373b539cefca4d3

SHA1
df9fc69ec43a5635eba806174925760151fffd81

SHA256
beea59b502b7f33b9ed410c01111b61e6d590ad1490615992753dd46ce3770b6

SHA512
6251846ab9bd94bfcc12dbbff785595db2c6cfa0f2b6591e080c648e9a5f1635ffc796a6d104946a4a55d88d265f83733e9da44be01f37f1c2be1a59d43e6a4c

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
224.5MB

MD5
707a8d6c59843ff6dd364da8c96136e2

SHA1
36129239d002c6142154d63102053f708514dcf6

SHA256
e8d8ad38d595746216a40bc8d82533283fcae1c292beefd33e5067b45e78efc2

SHA512
d9019df8224d8688fe5bd60cd75f2ea1a7ca238912341c91d8935d0d15b1cf92f450b49feba1dbbb6900f0bd0f76d8e9df6c5b1979cacccd589fd9cb393474fd

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
223.2MB

MD5
5e82d49c4dfef0987995ac694ff58f3e

SHA1
215fae5772c0de10aaa23995d1b1cb4bb14e1d3c

SHA256
f5c198a81170b705cb4098b04742ede0321e7d0dfad242cd5257e23640ad77f4

SHA512
3a008528f5e2ee66d92fe9776c0fdc103887118d37b8ccce101641281853d3f3962ffcf3caf822616a6d736b5636af0ba5795df558967ae4c79ac0bdca2fb6db

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
237.9MB

MD5
74355edf8f425c49b3e97d5fc089dbef

SHA1
7da706732feaf26a8518c75302a50eb6f1025efc

SHA256
99c9dc0e2400800d84f22fd6eb5a4cbe185a1ed0bf2f92f58d11b0b8ca924969

SHA512
b4df1837595edfd23682a07da64c0c386ca025f14d9877d4cc4599404cc3dfa87018cdb7a572391ee64055f6554549123ace60b584c511d3eb189365a3783c16

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
227.1MB

MD5
a349e52b02efac0a1a99991b39ce49c7

SHA1
9ffa7bd39fc13a668212c8caca13b7de7c2b1e1c

SHA256
f8904a6e15b1707e1c187b97acea3568abedd38be2b822600af703a48a4e700e

SHA512
4b48e5528163555a941c65b8444d6dfd5ea546f854e8528347973dc959f17e221fee15c6c37c41986f750d652ebbae5601bfa0abfb8987c60704725c7369c7b3

Download Submit
memory/520-69-0x00000000700E0000-0x000000007068B000-memory.dmp

Filesize
5.7MB

Download
memory/520-70-0x00000000700E0000-0x000000007068B000-memory.dmp

Filesize
5.7MB

Download
memory/520-71-0x00000000700E0000-0x000000007068B000-memory.dmp

Filesize
5.7MB

Download
memory/576-90-0x000000006FB30000-0x00000000700DB000-memory.dmp

Filesize
5.7MB

Download
memory/576-86-0x000000006FB30000-0x00000000700DB000-memory.dmp

Filesize
5.7MB

Download
memory/1472-66-0x0000000006450000-0x00000000067F0000-memory.dmp

Filesize
3.6MB

Download
memory/1472-65-0x0000000000930000-0x00000000010A4000-memory.dmp

Filesize
7.5MB

Download
memory/1472-73-0x0000000005460000-0x00000000055D2000-memory.dmp

Filesize
1.4MB

Download
memory/1620-85-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-80-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-82-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-84-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-78-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-76-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-88-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-89-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-94-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1620-95-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1756-56-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download