aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora persistence spyware stealer

Malware Config

Extracted

Family

aurora

C2

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

voiceadequovl.exevoiceadequovl.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe

Executes dropped EXE 3 IoCs

Processes:

voiceadequovl.exevoiceadequovl.exevoiceadequovl.exe

pid process

5044 voiceadequovl.exe
3644 voiceadequovl.exe
3896 voiceadequovl.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
5044	voiceadequovl.exe
3644	voiceadequovl.exe
3896	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

voiceadequovl.exe

description pid process target process

PID 3644 set thread context of 3896 3644 voiceadequovl.exe voiceadequovl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

2200 powershell.exe
2200 powershell.exe
2532 powershell.exe
2532 powershell.exe

description	pid	process	target process
PID 3644 set thread context of 3896	3644	voiceadequovl.exe	voiceadequovl.exe

pid	process
2200	powershell.exe
2200	powershell.exe
2532	powershell.exe
2532	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

voiceadequovl.exepowershell.exepowershell.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3644	voiceadequovl.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	2532	powershell.exe
Token: SeIncreaseQuotaPrivilege	4460	wmic.exe
Token: SeSecurityPrivilege	4460	wmic.exe
Token: SeTakeOwnershipPrivilege	4460	wmic.exe
Token: SeLoadDriverPrivilege	4460	wmic.exe
Token: SeSystemProfilePrivilege	4460	wmic.exe
Token: SeSystemtimePrivilege	4460	wmic.exe
Token: SeProfSingleProcessPrivilege	4460	wmic.exe
Token: SeIncBasePriorityPrivilege	4460	wmic.exe
Token: SeCreatePagefilePrivilege	4460	wmic.exe
Token: SeBackupPrivilege	4460	wmic.exe
Token: SeRestorePrivilege	4460	wmic.exe
Token: SeShutdownPrivilege	4460	wmic.exe
Token: SeDebugPrivilege	4460	wmic.exe
Token: SeSystemEnvironmentPrivilege	4460	wmic.exe
Token: SeRemoteShutdownPrivilege	4460	wmic.exe
Token: SeUndockPrivilege	4460	wmic.exe
Token: SeManageVolumePrivilege	4460	wmic.exe
Token: 33	4460	wmic.exe
Token: 34	4460	wmic.exe
Token: 35	4460	wmic.exe
Token: 36	4460	wmic.exe
Token: SeIncreaseQuotaPrivilege	4460	wmic.exe
Token: SeSecurityPrivilege	4460	wmic.exe
Token: SeTakeOwnershipPrivilege	4460	wmic.exe
Token: SeLoadDriverPrivilege	4460	wmic.exe
Token: SeSystemProfilePrivilege	4460	wmic.exe
Token: SeSystemtimePrivilege	4460	wmic.exe
Token: SeProfSingleProcessPrivilege	4460	wmic.exe
Token: SeIncBasePriorityPrivilege	4460	wmic.exe
Token: SeCreatePagefilePrivilege	4460	wmic.exe
Token: SeBackupPrivilege	4460	wmic.exe
Token: SeRestorePrivilege	4460	wmic.exe
Token: SeShutdownPrivilege	4460	wmic.exe
Token: SeDebugPrivilege	4460	wmic.exe
Token: SeSystemEnvironmentPrivilege	4460	wmic.exe
Token: SeRemoteShutdownPrivilege	4460	wmic.exe
Token: SeUndockPrivilege	4460	wmic.exe
Token: SeManageVolumePrivilege	4460	wmic.exe
Token: 33	4460	wmic.exe
Token: 34	4460	wmic.exe
Token: 35	4460	wmic.exe
Token: 36	4460	wmic.exe
Token: SeIncreaseQuotaPrivilege	3860	WMIC.exe
Token: SeSecurityPrivilege	3860	WMIC.exe
Token: SeTakeOwnershipPrivilege	3860	WMIC.exe
Token: SeLoadDriverPrivilege	3860	WMIC.exe
Token: SeSystemProfilePrivilege	3860	WMIC.exe
Token: SeSystemtimePrivilege	3860	WMIC.exe
Token: SeProfSingleProcessPrivilege	3860	WMIC.exe
Token: SeIncBasePriorityPrivilege	3860	WMIC.exe
Token: SeCreatePagefilePrivilege	3860	WMIC.exe
Token: SeBackupPrivilege	3860	WMIC.exe
Token: SeRestorePrivilege	3860	WMIC.exe
Token: SeShutdownPrivilege	3860	WMIC.exe
Token: SeDebugPrivilege	3860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3860	WMIC.exe
Token: SeRemoteShutdownPrivilege	3860	WMIC.exe
Token: SeUndockPrivilege	3860	WMIC.exe
Token: SeManageVolumePrivilege	3860	WMIC.exe
Token: 33	3860	WMIC.exe
Token: 34	3860	WMIC.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exevoiceadequovl.execmd.execmd.exe

description	pid	process	target process
PID 4276 wrote to memory of 5044	4276	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 4276 wrote to memory of 5044	4276	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 4276 wrote to memory of 5044	4276	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 5044 wrote to memory of 3644	5044	voiceadequovl.exe	voiceadequovl.exe
PID 5044 wrote to memory of 3644	5044	voiceadequovl.exe	voiceadequovl.exe
PID 5044 wrote to memory of 3644	5044	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 2200	3644	voiceadequovl.exe	powershell.exe
PID 3644 wrote to memory of 2200	3644	voiceadequovl.exe	powershell.exe
PID 3644 wrote to memory of 2200	3644	voiceadequovl.exe	powershell.exe
PID 3644 wrote to memory of 4172	3644	voiceadequovl.exe	cmd.exe
PID 3644 wrote to memory of 4172	3644	voiceadequovl.exe	cmd.exe
PID 3644 wrote to memory of 4172	3644	voiceadequovl.exe	cmd.exe
PID 4172 wrote to memory of 2532	4172	cmd.exe	powershell.exe
PID 4172 wrote to memory of 2532	4172	cmd.exe	powershell.exe
PID 4172 wrote to memory of 2532	4172	cmd.exe	powershell.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3644 wrote to memory of 3896	3644	voiceadequovl.exe	voiceadequovl.exe
PID 3896 wrote to memory of 4460	3896	voiceadequovl.exe	wmic.exe
PID 3896 wrote to memory of 4460	3896	voiceadequovl.exe	wmic.exe
PID 3896 wrote to memory of 4460	3896	voiceadequovl.exe	wmic.exe
PID 3896 wrote to memory of 3364	3896	voiceadequovl.exe	cmd.exe
PID 3896 wrote to memory of 3364	3896	voiceadequovl.exe	cmd.exe
PID 3896 wrote to memory of 3364	3896	voiceadequovl.exe	cmd.exe
PID 3364 wrote to memory of 3860	3364	cmd.exe	WMIC.exe
PID 3364 wrote to memory of 3860	3364	cmd.exe	WMIC.exe
PID 3364 wrote to memory of 3860	3364	cmd.exe	WMIC.exe
PID 3896 wrote to memory of 2228	3896	voiceadequovl.exe	cmd.exe
PID 3896 wrote to memory of 2228	3896	voiceadequovl.exe	cmd.exe
PID 3896 wrote to memory of 2228	3896	voiceadequovl.exe	cmd.exe
PID 2228 wrote to memory of 2128	2228	cmd.exe	WMIC.exe
PID 2228 wrote to memory of 2128	2228	cmd.exe	WMIC.exe
PID 2228 wrote to memory of 2128	2228	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4276

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
4⤵
- Suspicious use of WriteProcessMemory
PID:4172

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
5⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3860

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
5⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
6⤵
PID:2128

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
1970134382c0fd073f91056818eac9ef

SHA1
521583f90f141fa142e381cb9d8597bb19722ba2

SHA256
060430399c52c35497b532be6cbf0cec7115248749ec76e5aafb9346f05ffa21

SHA512
6e748638786a69209433250dbc4ac76ea647b3a9c955bb7077a52fbb087c5492b7f8fc3ad8485ff9231d37558c9f9b368a7facf17b78e0826e031f287be111b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
360.7MB

MD5
19d3f3b1a780220919d22452ee5d86d0

SHA1
bcac019bd029dab9555bdab832ba88c182f96855

SHA256
46d1cc9c9481429856ccc5a6429aff911882d81fa4782bb0d05b2da3a85e5c61

SHA512
7b8df149fca08adf8d91b36fab88e7fa20d2a0f9fca7ecae6eb6ce4177dc6acb2e128a663bbb3513ced84d1df41f69864bbc5b2b02b11ba5d55b0135f074240a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
345.9MB

MD5
46da932049579f269139e32e2378fc52

SHA1
d21f31a09c2f5ee20b414df051ad49c120c9afc8

SHA256
07273579b45a715552b41d56529e3df0e3d56206f78cbb5efd9152d7f14f0b44

SHA512
9ae687a9c378781874abdf1524253a865c7e8322c9f0ffdb4d84f6e3b071239ce018f3723cbeb6d8e62e9dd16565efb4eb478957e566882c020464e6d70a268c

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
318.6MB

MD5
597f5dea80c0d7608ecb2bffa968c76b

SHA1
8bd9d5b1fb9d970058daeee143cd19197c4d7b07

SHA256
4810932571fa943fa016e6e0b897e51542c85d0741083ef58f4d36033117149e

SHA512
1c87269771a4a58ac06251f236561129ff1d787816116d9625d3e9dc24e9c8953281a8b65afa678e4c55c2432d8c4f2fee39bc19e3905d030e45805b32799bc3

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
351.6MB

MD5
704f529bf8a4efd125e3cf98349c5a88

SHA1
50d9e69ab77c80d96a3285386165e0f9c3b95b16

SHA256
e07072cbfebb5eb6732aa2ba2c6513f8196429bfac902f164dbf69d56ff95db9

SHA512
57d2faae7bdbb2dfac6f72494c0d4c49b36a40b38122e8802b54a65de7a067cadc8b79690e4b23c633e6f6e73ec3aac2de72e8f9f8311052aa88074bf06c11e7

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
128.8MB

MD5
f0bb2454e04804a60159225f9d6a2555

SHA1
0908fa2fb52696d973f3dbbed7aca94f440cf9d8

SHA256
a6354d36ff7604685421e9c09055030b8bc9eeb243cc4ed4b2f3cf8276b2f8e4

SHA512
0da6c3a4bbad328345315a5445ffbbb63eea2b5d2ee3e66f08483e43ed5e2a02bfe7909cee6777c8ede8a9374ba53d6bb9f11bd87ef5c5474ff175f7d7d6514a

Download Submit
memory/2128-168-0x0000000000000000-mapping.dmp

Download
memory/2200-140-0x0000000000000000-mapping.dmp

Download
memory/2200-142-0x0000000005590000-0x0000000005BB8000-memory.dmp

Filesize
6.2MB

Download
memory/2200-143-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/2200-144-0x0000000005CC0000-0x0000000005D26000-memory.dmp

Filesize
408KB

Download
memory/2200-145-0x0000000006310000-0x000000000632E000-memory.dmp

Filesize
120KB

Download
memory/2200-146-0x0000000007950000-0x0000000007FCA000-memory.dmp

Filesize
6.5MB

Download
memory/2200-147-0x0000000006810000-0x000000000682A000-memory.dmp

Filesize
104KB

Download
memory/2200-141-0x00000000029F0000-0x0000000002A26000-memory.dmp

Filesize
216KB

Download
memory/2228-167-0x0000000000000000-mapping.dmp

Download
memory/2532-163-0x0000000006CF0000-0x0000000006CFA000-memory.dmp

Filesize
40KB

Download
memory/2532-162-0x00000000060D0000-0x00000000060EE000-memory.dmp

Filesize
120KB

Download
memory/2532-171-0x0000000006D30000-0x0000000006D38000-memory.dmp

Filesize
32KB

Download
memory/2532-149-0x0000000000000000-mapping.dmp

Download
memory/2532-170-0x0000000006D50000-0x0000000006D6A000-memory.dmp

Filesize
104KB

Download
memory/2532-169-0x00000000059D0000-0x00000000059DE000-memory.dmp

Filesize
56KB

Download
memory/2532-165-0x0000000007180000-0x0000000007216000-memory.dmp

Filesize
600KB

Download
memory/2532-159-0x00000000060F0000-0x0000000006122000-memory.dmp

Filesize
200KB

Download
memory/2532-161-0x0000000073230000-0x000000007327C000-memory.dmp

Filesize
304KB

Download
memory/3364-164-0x0000000000000000-mapping.dmp

Download
memory/3644-138-0x00000000007E0000-0x0000000000F54000-memory.dmp

Filesize
7.5MB

Download
memory/3644-139-0x0000000006EC0000-0x0000000006EE2000-memory.dmp

Filesize
136KB

Download
memory/3644-135-0x0000000000000000-mapping.dmp

Download
memory/3860-166-0x0000000000000000-mapping.dmp

Download
memory/3896-157-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3896-151-0x0000000000000000-mapping.dmp

Download
memory/3896-155-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3896-152-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3896-172-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4172-148-0x0000000000000000-mapping.dmp

Download
memory/4460-160-0x0000000000000000-mapping.dmp

Download
memory/5044-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads