aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
145s
max time network
153s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-02-2023 12:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora purecrypter downloader loader persistence stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Detect PureCrypter injector 1 IoCs

loader

resource	yara_rule
behavioral1/memory/1464-66-0x0000000006490000-0x0000000006830000-memory.dmp	family_purecrypter

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter

Executes dropped EXE 2 IoCs

pid	Process
1508	voiceadequovl.exe
1464	voiceadequovl.exe

Loads dropped DLL 4 IoCs

pid	Process
1508	voiceadequovl.exe
1508	voiceadequovl.exe
1508	voiceadequovl.exe
1508	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1420	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	voiceadequovl.exe
Token: SeDebugPrivilege	1420	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1508	1532	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1532 wrote to memory of 1508	1532	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1532 wrote to memory of 1508	1532	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1532 wrote to memory of 1508	1532	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	28
PID 1508 wrote to memory of 1464	1508	voiceadequovl.exe	29
PID 1508 wrote to memory of 1464	1508	voiceadequovl.exe	29
PID 1508 wrote to memory of 1464	1508	voiceadequovl.exe	29
PID 1508 wrote to memory of 1464	1508	voiceadequovl.exe	29
PID 1464 wrote to memory of 1420	1464	voiceadequovl.exe	30
PID 1464 wrote to memory of 1420	1464	voiceadequovl.exe	30
PID 1464 wrote to memory of 1420	1464	voiceadequovl.exe	30
PID 1464 wrote to memory of 1420	1464	voiceadequovl.exe	30

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
    "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1420
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
      4⤵
      PID:964
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
        5⤵
        
        PID:792
  - - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
      4⤵
      PID:824
    - - C:\Windows\SysWOW64\Wbem\wmic.exe
        
        wmic os get Caption
        5⤵
        
        PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
235.6MB

MD5
05d7e04cc6eb9240b95985c0fa3ccd6a

SHA1
6b27fe64076467874eae0ae1ebcac455894b3cf0

SHA256
e4de7b4c52741528e5315c6804b5ff1db070cecbed015b89bf73fb73915343b0

SHA512
4ac5151a45e82cbae09cabb0b9e397c6c8699eecacd6d757ba63d155ff9bf42bad17724bfbb1f7a9728d19e18262d602c946d2953b83bce4320b32ad510085fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ba851aa7f496fb22e40451ccf1e7ada9

SHA1
a6767cb66e312e3bdbe8ce7edf6167c4db542abe

SHA256
51629c7313c4427ac3d60368438f3feb830d88688076ba92b94affff06142242

SHA512
1ada2aaf0fd9a34efcb53e19a0675caf75156e95442a3fbe8984fc84515efeb56f530879fc76bb5a9478fdcdfeb87000036f728e0ef53a5bd88a2913bf7dc0af

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
265.9MB

MD5
cbca52b9c8fa5a1ad3605b780a9d46d4

SHA1
b91ce0a9007a2ffd7281fe5254fbe4a17715dfd1

SHA256
83988d5087d950a5f586aa0a0b3e7c4e171445323fa54659d0a584adb1953052

SHA512
19e90ebd250feac25c7ab4f60cb0b528db0aea4dcc7e6b96c878b066135076626229f50a5340d5e00d8596e45fbedd75d04238d96f847241fc1fbefeb82df803

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
223.2MB

MD5
2508302155b449f7f2cec7894046361e

SHA1
1b48aee73a59e32090a66a0f49a7460c2878ed16

SHA256
72a82396d89864e8cd9a7ac2c0264a8e9ab776655c62f1519b6d7fda06bb6869

SHA512
51641c98f4947a26fde8c2a5f9eeb3e7d287e18368ce3b223bf3eee7e9daa9c65b2fc67243a039194bea3163c51408462bdcdbcce8b045c9a4fad62c67eb8e07

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
3.4MB

MD5
0f8ee7d28240e90d42b917630bf7c714

SHA1
96bb974bea98726256178620d4c572b7b92eebc6

SHA256
85abbd88e135a6313a39d1ad4d185e82ffed74b46757a1d5bcf78743ac048652

SHA512
f2f8e6a8c32a1555a242e07602e5c23bc029d2a87b68073534e3fcf5a6b15b64f0c9f0dce88c652d3279790589330020a8ac8766c321ef7d8e89ffcf1af12d57

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
2.5MB

MD5
bee69ffd55efcae53fc51cf24c604ff7

SHA1
b9914fa41a4457fbb3a246df3ea2f0bd356a6bd9

SHA256
920e5b47cac5c0d1b274ddeadca3256a5bb3a2b6f128267e234876e827f88afa

SHA512
a9660a8d87141f8bc28caf00e80c7fdcd4c054183f07a20a02b2292d7c65563d25f70c3b805f600128c57b57d1dbc83c16eb35834007a781dd94b993da955c27

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
267.8MB

MD5
cd9dab716dbfb42ff0fd56cf00a8685b

SHA1
8324cf61b960c22774d248cfa08b22ac608c09db

SHA256
5642fbb4fbc44e9044ce851ba2cea82cc2eddbed40cfbde6711374c8b7b33883

SHA512
89ea86a8319f7c9f0dfc1b6dac325e10760adb7789ccbfc59a7863c5c148caf1029dc4c460dc11fa759241777cf304e4ff70695e5ac8df7e447a9da8f7d83533

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
264.8MB

MD5
211a8dad24362cb8685d324f4712be6a

SHA1
190959a09eff20b23d4dd2830ce5df2b86c46bb3

SHA256
20ad08b5454466f62da75c8fc184684a9570b2aaf16fe6c36e311f28302b2ca6

SHA512
778e17580f4c0e68f06b9636100ba86d042a744cbfbe04a520baf5bc957362cbcc4b68080713397150708e63c5c407ebb687be1d1e88964be9bca13c62adb8b7

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
265.7MB

MD5
e20e85be57487ef785696aae80ef6e6e

SHA1
c353dbdad47da5b33e9053265589ba24279d2bc0

SHA256
df50ea1505eae0503f49928758eafe649310f3de958edc92c53add79b8459c4b

SHA512
ee04c1a6d0b9e81955acc3ba32128d8bbad0c2fa89cdd21d7c85424c015cfb159b9df954b287cd48807b1f9e26454d975ab7936bd865ad22d1bd807a87393509

Download Submit
\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

Filesize
241.9MB

MD5
a711a471e3b0ffaff3811b0b47693c3d

SHA1
8fed126e403374596b96c6df2864cfdb74c28ccf

SHA256
24970f3bee8ce6a5f22823eee4d92cb8cc8fd987ccdaaffe85cd57e2ab481fa6

SHA512
dcd2308d11ed9ef40fc17bc23183a94f19e0d67aad080b7e323f3fccee42ec1f3c4689dc9619fdf6a39e2c8a25c42d966c91b8f5c922d62c42b478d75344e328

Download Submit
memory/792-94-0x000000006F330000-0x000000006F8DB000-memory.dmp

Filesize
5.7MB

Download
memory/792-96-0x000000006F330000-0x000000006F8DB000-memory.dmp

Filesize
5.7MB

Download
memory/824-86-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-83-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-95-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-93-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-89-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-77-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-78-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-88-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-81-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/824-85-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1420-70-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/1420-69-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/1420-71-0x000000006F5E0000-0x000000006FB8B000-memory.dmp

Filesize
5.7MB

Download
memory/1464-66-0x0000000006490000-0x0000000006830000-memory.dmp

Filesize
3.6MB

Download
memory/1464-73-0x0000000005460000-0x00000000055D2000-memory.dmp

Filesize
1.4MB

Download
memory/1464-65-0x0000000000F00000-0x0000000001674000-memory.dmp

Filesize
7.5MB

Download
memory/1508-56-0x0000000075C81000-0x0000000075C83000-memory.dmp

Filesize
8KB

Download