aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
54s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2023 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora persistence stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

voiceadequovl.exevoiceadequovl.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe

Executes dropped EXE 4 IoCs

Processes:

voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exe

pid process

4788 voiceadequovl.exe
5076 voiceadequovl.exe
3980 voiceadequovl.exe
4312 voiceadequovl.exe

pid	process
4788	voiceadequovl.exe
5076	voiceadequovl.exe
3980	voiceadequovl.exe
4312	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

voiceadequovl.exe

description pid process target process

PID 5076 set thread context of 4312 5076 voiceadequovl.exe voiceadequovl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exevoiceadequovl.exepowershell.exe

pid process

4832 powershell.exe
4832 powershell.exe
5076 voiceadequovl.exe
5076 voiceadequovl.exe
4720 powershell.exe
4720 powershell.exe

description	pid	process	target process
PID 5076 set thread context of 4312	5076	voiceadequovl.exe	voiceadequovl.exe

pid	process
4832	powershell.exe
4832	powershell.exe
5076	voiceadequovl.exe
5076	voiceadequovl.exe
4720	powershell.exe
4720	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

voiceadequovl.exepowershell.exepowershell.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	5076	voiceadequovl.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeIncreaseQuotaPrivilege	2588	wmic.exe
Token: SeSecurityPrivilege	2588	wmic.exe
Token: SeTakeOwnershipPrivilege	2588	wmic.exe
Token: SeLoadDriverPrivilege	2588	wmic.exe
Token: SeSystemProfilePrivilege	2588	wmic.exe
Token: SeSystemtimePrivilege	2588	wmic.exe
Token: SeProfSingleProcessPrivilege	2588	wmic.exe
Token: SeIncBasePriorityPrivilege	2588	wmic.exe
Token: SeCreatePagefilePrivilege	2588	wmic.exe
Token: SeBackupPrivilege	2588	wmic.exe
Token: SeRestorePrivilege	2588	wmic.exe
Token: SeShutdownPrivilege	2588	wmic.exe
Token: SeDebugPrivilege	2588	wmic.exe
Token: SeSystemEnvironmentPrivilege	2588	wmic.exe
Token: SeRemoteShutdownPrivilege	2588	wmic.exe
Token: SeUndockPrivilege	2588	wmic.exe
Token: SeManageVolumePrivilege	2588	wmic.exe
Token: 33	2588	wmic.exe
Token: 34	2588	wmic.exe
Token: 35	2588	wmic.exe
Token: 36	2588	wmic.exe
Token: SeIncreaseQuotaPrivilege	2588	wmic.exe
Token: SeSecurityPrivilege	2588	wmic.exe
Token: SeTakeOwnershipPrivilege	2588	wmic.exe
Token: SeLoadDriverPrivilege	2588	wmic.exe
Token: SeSystemProfilePrivilege	2588	wmic.exe
Token: SeSystemtimePrivilege	2588	wmic.exe
Token: SeProfSingleProcessPrivilege	2588	wmic.exe
Token: SeIncBasePriorityPrivilege	2588	wmic.exe
Token: SeCreatePagefilePrivilege	2588	wmic.exe
Token: SeBackupPrivilege	2588	wmic.exe
Token: SeRestorePrivilege	2588	wmic.exe
Token: SeShutdownPrivilege	2588	wmic.exe
Token: SeDebugPrivilege	2588	wmic.exe
Token: SeSystemEnvironmentPrivilege	2588	wmic.exe
Token: SeRemoteShutdownPrivilege	2588	wmic.exe
Token: SeUndockPrivilege	2588	wmic.exe
Token: SeManageVolumePrivilege	2588	wmic.exe
Token: 33	2588	wmic.exe
Token: 34	2588	wmic.exe
Token: 35	2588	wmic.exe
Token: 36	2588	wmic.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.exe

description	pid	process	target process
PID 3820 wrote to memory of 4788	3820	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 3820 wrote to memory of 4788	3820	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 3820 wrote to memory of 4788	3820	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 4788 wrote to memory of 5076	4788	voiceadequovl.exe	voiceadequovl.exe
PID 4788 wrote to memory of 5076	4788	voiceadequovl.exe	voiceadequovl.exe
PID 4788 wrote to memory of 5076	4788	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4832	5076	voiceadequovl.exe	powershell.exe
PID 5076 wrote to memory of 4832	5076	voiceadequovl.exe	powershell.exe
PID 5076 wrote to memory of 4832	5076	voiceadequovl.exe	powershell.exe
PID 5076 wrote to memory of 4572	5076	voiceadequovl.exe	cmd.exe
PID 5076 wrote to memory of 4572	5076	voiceadequovl.exe	cmd.exe
PID 5076 wrote to memory of 4572	5076	voiceadequovl.exe	cmd.exe
PID 4572 wrote to memory of 4720	4572	cmd.exe	powershell.exe
PID 4572 wrote to memory of 4720	4572	cmd.exe	powershell.exe
PID 4572 wrote to memory of 4720	4572	cmd.exe	powershell.exe
PID 5076 wrote to memory of 3980	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 3980	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 3980	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 5076 wrote to memory of 4312	5076	voiceadequovl.exe	voiceadequovl.exe
PID 4312 wrote to memory of 2588	4312	voiceadequovl.exe	wmic.exe
PID 4312 wrote to memory of 2588	4312	voiceadequovl.exe	wmic.exe
PID 4312 wrote to memory of 2588	4312	voiceadequovl.exe	wmic.exe

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
    "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5076
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
  - - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      4⤵
      Executes dropped EXE
      PID:3980
  - - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4312
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2588
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic path win32_VideoController get name"
        5⤵
        
        PID:4472
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        6⤵
        
        PID:3880
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /C "wmic cpu get name"
        5⤵
        
        PID:3828

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
75df909a4835b7ba8b80b4a8ab4eae4e

SHA1
b31b2c66dd24aeeec827961aa2972088697fb779

SHA256
e13b64e4bb612eb6a0bc647aefaf6a53e9ffd6846b759ea79bc36134df663b25

SHA512
4fb9e43e3297e09dfc575852fb0fe42278e6ab553bd0c9afadf9d6c6ad72de151ce4067d81291c5007dc2d9aa2033d956d6e3b03675a15912c7211cc400a73d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
342.8MB

MD5
47c33bfb5fad31b648678f5484636393

SHA1
995c20d05a80f79ef15506880b6964897cc41c85

SHA256
d025f2ce3ec54279411b380276d7f650a7c760c7314821a914c60ee4d36d35a9

SHA512
218f3c69f8e35796513e813917cc1666920366291474a2458b8b65375dbda72961726ebf16e3056e40d29ade2252f859e31393908ef35a023e66da6bddc62230

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
351.0MB

MD5
fc6aa8083255ca098becf9d80c0d4cf7

SHA1
92893c5b7bb207033ee8bae7320fd2cd333b1d18

SHA256
417b8e368871b8f00565796436b6b03be2b795507d00b0ec22ad88901619456d

SHA512
c62874ec34d8665a6c4c886ee50d8f318155495330493e79239bd0ead9c2e7708b6de8a917707b27bed10dabd79dd9c9b99dce44a4c59e7a8aca8ff6c4ccd69c

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
308.9MB

MD5
3822a4a0880897737ceb26ed492b1837

SHA1
244042e978799d34827a63f9aaed9d80b8bf008b

SHA256
a716517a3735a1c2798c96ac1611fbc3f998da40d8f87cadeb95f5947598b5e2

SHA512
bd72928565b0ca45eee394661ef0a24d5795c59846ebe074a350f25bd7f6972a7ac7e649de810f558be52a0f1da90c466cda1772141b2a91add909dac5f7aa06

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
248.7MB

MD5
bff6d6ac47a8e749a7a0a8e7022ef07f

SHA1
ea28e5b9c35c57611c96f3592a26818311333ffe

SHA256
c1c50cc3fb877f25d03bae1f123a1d08b8bc315b27f4095dd5a60a11a3724ec2

SHA512
22dcaf5fb47e6558d864080b2899a08f84ceba7b83d4a63d1e9f065e2662b1fa156546afe15632e74bf06a5347f67f2cc932eb2c8188992c97c6bcffba70eff6

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
265.1MB

MD5
de237b6bb89d1b068aa7c1b9a9f63988

SHA1
1a6343a59946e18058c20b1ed93a00c47a861146

SHA256
9c76900b07766cb75089eb8af615d21aa9f2cb688e45db062b7a0c2ca1982c10

SHA512
f0eb9f688b0f9aa371db744e5130ad14380db388bfcbbee2e04cd5375d797ea75ff1c1ede25c4e515e9a90b4d2b53bd176618a009fdb1af315b8ea84698b869c

Download Submit
memory/2588-165-0x0000000000000000-mapping.dmp

Download
memory/3828-169-0x0000000000000000-mapping.dmp

Download
memory/3880-168-0x0000000000000000-mapping.dmp

Download
memory/3980-151-0x0000000000000000-mapping.dmp

Download
memory/4196-171-0x0000000000000000-mapping.dmp

Download
memory/4312-159-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4312-157-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4312-174-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4312-153-0x0000000000000000-mapping.dmp

Download
memory/4312-154-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4472-167-0x0000000000000000-mapping.dmp

Download
memory/4572-148-0x0000000000000000-mapping.dmp

Download
memory/4720-163-0x0000000006B30000-0x0000000006B4E000-memory.dmp

Filesize
120KB

Download
memory/4720-164-0x0000000006F60000-0x0000000006F6A000-memory.dmp

Filesize
40KB

Download
memory/4720-173-0x00000000070F0000-0x00000000070F8000-memory.dmp

Filesize
32KB

Download
memory/4720-172-0x0000000007110000-0x000000000712A000-memory.dmp

Filesize
104KB

Download
memory/4720-170-0x0000000005A30000-0x0000000005A3E000-memory.dmp

Filesize
56KB

Download
memory/4720-166-0x0000000007190000-0x0000000007226000-memory.dmp

Filesize
600KB

Download
memory/4720-149-0x0000000000000000-mapping.dmp

Download
memory/4720-161-0x0000000006B70000-0x0000000006BA2000-memory.dmp

Filesize
200KB

Download
memory/4720-162-0x0000000075390000-0x00000000753DC000-memory.dmp

Filesize
304KB

Download
memory/4788-132-0x0000000000000000-mapping.dmp

Download
memory/4832-142-0x00000000050A0000-0x00000000056C8000-memory.dmp

Filesize
6.2MB

Download
memory/4832-143-0x00000000058B0000-0x0000000005916000-memory.dmp

Filesize
408KB

Download
memory/4832-144-0x0000000005920000-0x0000000005986000-memory.dmp

Filesize
408KB

Download
memory/4832-141-0x0000000004A30000-0x0000000004A66000-memory.dmp

Filesize
216KB

Download
memory/4832-140-0x0000000000000000-mapping.dmp

Download
memory/4832-145-0x0000000006020000-0x000000000603E000-memory.dmp

Filesize
120KB

Download
memory/4832-147-0x0000000006500000-0x000000000651A000-memory.dmp

Filesize
104KB

Download
memory/4832-146-0x0000000007880000-0x0000000007EFA000-memory.dmp

Filesize
6.5MB

Download
memory/5076-139-0x0000000006F60000-0x0000000006F82000-memory.dmp

Filesize
136KB

Download
memory/5076-138-0x0000000000870000-0x0000000000FE4000-memory.dmp

Filesize
7.5MB

Download
memory/5076-135-0x0000000000000000-mapping.dmp

Download