aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
57s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2023 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora persistence stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

voiceadequovl.exevoiceadequovl.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe

Executes dropped EXE 4 IoCs

Processes:

voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exe

pid process

2308 voiceadequovl.exe
2740 voiceadequovl.exe
1212 voiceadequovl.exe
3684 voiceadequovl.exe

pid	process
2308	voiceadequovl.exe
2740	voiceadequovl.exe
1212	voiceadequovl.exe
3684	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

voiceadequovl.exe

description pid process target process

PID 2740 set thread context of 3684 2740 voiceadequovl.exe voiceadequovl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exevoiceadequovl.exe

pid process

2180 powershell.exe
2180 powershell.exe
3868 powershell.exe
2740 voiceadequovl.exe
2740 voiceadequovl.exe
3868 powershell.exe

description	pid	process	target process
PID 2740 set thread context of 3684	2740	voiceadequovl.exe	voiceadequovl.exe

pid	process
2180	powershell.exe
2180	powershell.exe
3868	powershell.exe
2740	voiceadequovl.exe
2740	voiceadequovl.exe
3868	powershell.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

voiceadequovl.exepowershell.exepowershell.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	2740	voiceadequovl.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	3868	powershell.exe
Token: SeIncreaseQuotaPrivilege	1892	wmic.exe
Token: SeSecurityPrivilege	1892	wmic.exe
Token: SeTakeOwnershipPrivilege	1892	wmic.exe
Token: SeLoadDriverPrivilege	1892	wmic.exe
Token: SeSystemProfilePrivilege	1892	wmic.exe
Token: SeSystemtimePrivilege	1892	wmic.exe
Token: SeProfSingleProcessPrivilege	1892	wmic.exe
Token: SeIncBasePriorityPrivilege	1892	wmic.exe
Token: SeCreatePagefilePrivilege	1892	wmic.exe
Token: SeBackupPrivilege	1892	wmic.exe
Token: SeRestorePrivilege	1892	wmic.exe
Token: SeShutdownPrivilege	1892	wmic.exe
Token: SeDebugPrivilege	1892	wmic.exe
Token: SeSystemEnvironmentPrivilege	1892	wmic.exe
Token: SeRemoteShutdownPrivilege	1892	wmic.exe
Token: SeUndockPrivilege	1892	wmic.exe
Token: SeManageVolumePrivilege	1892	wmic.exe
Token: 33	1892	wmic.exe
Token: 34	1892	wmic.exe
Token: 35	1892	wmic.exe
Token: 36	1892	wmic.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.exe

description	pid	process	target process
PID 5068 wrote to memory of 2308	5068	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 5068 wrote to memory of 2308	5068	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 5068 wrote to memory of 2308	5068	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 2308 wrote to memory of 2740	2308	voiceadequovl.exe	voiceadequovl.exe
PID 2308 wrote to memory of 2740	2308	voiceadequovl.exe	voiceadequovl.exe
PID 2308 wrote to memory of 2740	2308	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 2180	2740	voiceadequovl.exe	powershell.exe
PID 2740 wrote to memory of 2180	2740	voiceadequovl.exe	powershell.exe
PID 2740 wrote to memory of 2180	2740	voiceadequovl.exe	powershell.exe
PID 2740 wrote to memory of 3548	2740	voiceadequovl.exe	cmd.exe
PID 2740 wrote to memory of 3548	2740	voiceadequovl.exe	cmd.exe
PID 2740 wrote to memory of 3548	2740	voiceadequovl.exe	cmd.exe
PID 3548 wrote to memory of 3868	3548	cmd.exe	powershell.exe
PID 3548 wrote to memory of 3868	3548	cmd.exe	powershell.exe
PID 3548 wrote to memory of 3868	3548	cmd.exe	powershell.exe
PID 2740 wrote to memory of 1212	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 1212	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 1212	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 2740 wrote to memory of 3684	2740	voiceadequovl.exe	voiceadequovl.exe
PID 3684 wrote to memory of 1892	3684	voiceadequovl.exe	wmic.exe
PID 3684 wrote to memory of 1892	3684	voiceadequovl.exe	wmic.exe
PID 3684 wrote to memory of 1892	3684	voiceadequovl.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
4⤵
- Suspicious use of WriteProcessMemory
PID:3548

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
PID:1212

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
5⤵
PID:1588

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
PID:4668

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
5⤵
PID:3368

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
6⤵
PID:4652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
78e232ee82d18a1cdb9de2b92dafa2f9

SHA1
af09f460ce332cb37ed68882749cbd1a9be7eddd

SHA256
200eb5ca5006ec44e36ed2efe0d556ae9997b79a361a9c8fae1f7eb2a4e40f82

SHA512
6807f644abac30ab645eec3cc3fdf1f9fd31f57348f1d0b8e6b3e935067d7edb706f0cff39c60dfcd52272859618014dd308f08ba31b18025c42114036a21730

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
171.2MB

MD5
4c453d466798307341c8ac4b9cc49d7e

SHA1
f54503d717b38f607c5b7d478e897cc1a94b6d01

SHA256
2d49bea739f40b1f5bfe60848e32e738a1adc18e55ec32c77b49b2ad57a9683d

SHA512
584b6e400bef2f5ee03d71f2455200335cafcbe3735a4902067007052050fc02fecf9b982aaec08ec94104c6bd8f96757c9ee276f287e2c0bf54e6a5bf269aad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
150.2MB

MD5
94f86dcb00491c072cee0eebb6c77b04

SHA1
b7f4c91f178586faee7c13d796f0368637d45c3c

SHA256
b0572a4ba5b38558eb5eaa9ca916f8cb2c66dcc6b248d9dd39bd661295958063

SHA512
950e723b210145b81a482c3969ee34021107a7a483bc657d4ffe252f52c3b5959cbd09b37fe13d8be2a9bc289fd40e7f3c59f05ea1113023c7e3c585f0cb7f0f

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
127.0MB

MD5
613eac2ca6ba5dd0d0c5cd43dc3eb2b8

SHA1
4d7b397576bc5b24def95a90065ff7f3a5b3034c

SHA256
c7a0bd6ae6367b4ccd3888bcd0870465dac979e0f6e446176192cd2fca93f127

SHA512
b17b04adb44a94003981ce677352000db4b51ccfe722f8afbfa21634f2ed243bb9ff211c4ad0cf3b2e9fa331275469edf57a3ab1243b2ff0f404ff8ac9786cd5

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
123.5MB

MD5
da4e5319ab6d84f43e6db2e2305b6c1f

SHA1
29b128f81ae15c14367629bb604cb767a331e960

SHA256
fdbf050c1f2af0e7780e23241cf32ef556e96686f93c3143379d4584d1104dc6

SHA512
6d19008c9f2fe107f5dea691ffd27a7d31e280bc1bc27ed0f04c8a9102d141139807a116861ab97f014be864b9d411b9ed02ed7eaeaae879a5dbc3d2135fd93e

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
65.3MB

MD5
b8ea11f52871173fcbcd83a356c4e8cc

SHA1
8e2c444bd498e7fea84436c9e1604ce9edd3d0cb

SHA256
e453a9f7f32b05f513189afb264713a5e58af02c82ac0187f7797d770544c0d2

SHA512
9d84aa1b897957761055f6a2fa4672f10fd45ff683bb882abdb21b10b5870c90c5edff26d0cb204877d988190e200203d1b9390a4bf314c4c00dc5d18eedec48

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
64.0MB

MD5
875f16616a940097dddcf2bdf104e659

SHA1
3c6f16ae479d2b8497233645bc188dc46fc39ce7

SHA256
0529892c0c5f4414687217a5df7f9cd24a28c63e5733479553de6e2267cb1d8c

SHA512
8a3ba7cf6c958cb65e29ba52f89fda046898f7bbb4a9f13030e2a491de4bb7494fe480cf2c6cc0e8f392e6a30de20c7eded87811066dd57b8238561e88543c4c

Download Submit
memory/1212-151-0x0000000000000000-mapping.dmp

Download
memory/1588-167-0x0000000000000000-mapping.dmp

Download
memory/1892-164-0x0000000000000000-mapping.dmp

Download
memory/2180-142-0x0000000005710000-0x0000000005D38000-memory.dmp

Filesize
6.2MB

Download
memory/2180-141-0x00000000050A0000-0x00000000050D6000-memory.dmp

Filesize
216KB

Download
memory/2180-147-0x0000000006B60000-0x0000000006B7A000-memory.dmp

Filesize
104KB

Download
memory/2180-146-0x0000000007CA0000-0x000000000831A000-memory.dmp

Filesize
6.5MB

Download
memory/2180-145-0x0000000006660000-0x000000000667E000-memory.dmp

Filesize
120KB

Download
memory/2180-140-0x0000000000000000-mapping.dmp

Download
memory/2180-144-0x0000000006010000-0x0000000006076000-memory.dmp

Filesize
408KB

Download
memory/2180-143-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/2308-132-0x0000000000000000-mapping.dmp

Download
memory/2740-139-0x0000000007120000-0x0000000007142000-memory.dmp

Filesize
136KB

Download
memory/2740-138-0x0000000000A60000-0x00000000011D4000-memory.dmp

Filesize
7.5MB

Download
memory/2740-135-0x0000000000000000-mapping.dmp

Download
memory/3368-169-0x0000000000000000-mapping.dmp

Download
memory/3548-148-0x0000000000000000-mapping.dmp

Download
memory/3684-153-0x0000000000000000-mapping.dmp

Download
memory/3684-157-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3684-174-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3684-159-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3684-154-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3868-165-0x0000000007080000-0x000000000708A000-memory.dmp

Filesize
40KB

Download
memory/3868-163-0x0000000006280000-0x000000000629E000-memory.dmp

Filesize
120KB

Download
memory/3868-166-0x00000000072C0000-0x0000000007356000-memory.dmp

Filesize
600KB

Download
memory/3868-162-0x0000000075010000-0x000000007505C000-memory.dmp

Filesize
304KB

Download
memory/3868-161-0x00000000062A0000-0x00000000062D2000-memory.dmp

Filesize
200KB

Download
memory/3868-171-0x0000000005B50000-0x0000000005B5E000-memory.dmp

Filesize
56KB

Download
memory/3868-172-0x0000000007220000-0x000000000723A000-memory.dmp

Filesize
104KB

Download
memory/3868-173-0x0000000007200000-0x0000000007208000-memory.dmp

Filesize
32KB

Download
memory/3868-149-0x0000000000000000-mapping.dmp

Download
memory/4652-170-0x0000000000000000-mapping.dmp

Download
memory/4668-168-0x0000000000000000-mapping.dmp

Download