Analysis

  • max time kernel
    133s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-02-2023 13:19

General

  • Target

    5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

  • Size

    3.6MB

  • MD5

    36fd273ea7607d3a203f257f4e2649ed

  • SHA1

    5e243f79ecb539d0d1f75fce7ddfedeccee70a48

  • SHA256

    471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

  • SHA512

    cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d

  • SSDEEP

    98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Malware Config

Extracted

Family

aurora

C2

45.9.74.11:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
    "C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4904
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
        "C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:628
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:224
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2908
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4644
        • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
          C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
          4⤵
          • Executes dropped EXE
          PID:1272
        • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
          C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
          4⤵
          • Executes dropped EXE
          PID:1948
          • C:\Windows\SysWOW64\Wbem\wmic.exe
            wmic os get Caption
            5⤵
              PID:1092
            • C:\Windows\SysWOW64\cmd.exe
              cmd /C "wmic path win32_VideoController get name"
              5⤵
                PID:1320
                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                  wmic path win32_VideoController get name
                  6⤵
                    PID:3064
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /C "wmic cpu get name"
                  5⤵
                    PID:3624
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic cpu get name
                      6⤵
                        PID:4100

            Network

            • flag-us
              DNS
              97.97.242.52.in-addr.arpa
              Remote address:
              8.8.8.8:53
              Request
              97.97.242.52.in-addr.arpa
              IN PTR
              Response
            • flag-us
              DNS
              9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
              Remote address:
              8.8.8.8:53
              Request
              9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
              IN PTR
              Response
            • 72.21.81.240:80
              260 B
              5
            • 72.21.81.240:80
              322 B
              7
            • 72.21.81.240:80
              260 B
              5
            • 104.80.225.205:443
              322 B
              7
            • 45.9.74.11:8081
              144 B
              97 B
              3
              2
            • 8.8.8.8:53
              97.97.242.52.in-addr.arpa
              dns
              71 B
              145 B
              1
              1

              DNS Request

              97.97.242.52.in-addr.arpa

            • 8.8.8.8:53
              9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa
              dns
              118 B
              204 B
              1
              1

              DNS Request

              9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

              Filesize

              1KB

              MD5

              4280e36a29fa31c01e4d8b2ba726a0d8

              SHA1

              c485c2c9ce0a99747b18d899b71dfa9a64dabe32

              SHA256

              e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

              SHA512

              494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

              Filesize

              53KB

              MD5

              06ad34f9739c5159b4d92d702545bd49

              SHA1

              9152a0d4f153f3f40f7e606be75f81b582ee0c17

              SHA256

              474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

              SHA512

              c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

              Filesize

              16KB

              MD5

              2d2183a43f7541533befb418f5fbe520

              SHA1

              243947a911e345f84800335fac967ffa1b35ce35

              SHA256

              4e3f1e84192e55b0d54f2c0f4f19fc108eaa7374f1458da8a593ce6b573990e3

              SHA512

              134a284647f356cd86870d6b7f596ddc0571785129c923e0f09246cd26eda40f340bf1b69d7215a264c3afbfbc9d53441c977d8f9e9327770a8109bceaf41fdc

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

              Filesize

              365.5MB

              MD5

              ba50f2bca86ba947a8d2035bb9b35123

              SHA1

              a542b5c5d41174dc2475a219978123b7d14f958f

              SHA256

              17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

              SHA512

              08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe

              Filesize

              365.5MB

              MD5

              ba50f2bca86ba947a8d2035bb9b35123

              SHA1

              a542b5c5d41174dc2475a219978123b7d14f958f

              SHA256

              17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

              SHA512

              08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

            • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

              Filesize

              369.8MB

              MD5

              14a9737eb666769fee7c28a00eb14e82

              SHA1

              ab8f2279f13a546fc32233a4da0855660fb07ec0

              SHA256

              a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a

              SHA512

              973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7

            • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

              Filesize

              369.8MB

              MD5

              14a9737eb666769fee7c28a00eb14e82

              SHA1

              ab8f2279f13a546fc32233a4da0855660fb07ec0

              SHA256

              a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a

              SHA512

              973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7

            • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

              Filesize

              159.7MB

              MD5

              2e2cadc82b10b7128f5f1cee299e0351

              SHA1

              0d5404b45e54356fe474962a3802dd507f3d6294

              SHA256

              c1bf8f0b68b5b09e324ae42969d9b6cd00c7d026bbade9c615b01a48f4aa22a8

              SHA512

              d5a667057cb9aa9b4bb3babb4980ac12fadca351f5420fa97eccba5a650da547d1dfbe8aeed544959355ba3da38e8d860024bb67f8a2745433029ca720e9aa64

            • C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe

              Filesize

              162.2MB

              MD5

              b41b382e3dfd828e6a32f52df21a2333

              SHA1

              737ecf56c14d70f90e3d2f209520e5b45968eeae

              SHA256

              262e0d4c138598c655e07029ad798d5d4e24057c003b6ba0c5d0d869e127237d

              SHA512

              daec1f343c2b60b3917413481eb31d1b347d73dbad78b0a3fbd9ff6b992f5a24578c2cbbd7f5ec50ec7b81bc0f33a49010481d05fcf2bdf2e3a8d4323712a04a

            • memory/224-141-0x00000000046F0000-0x0000000004726000-memory.dmp

              Filesize

              216KB

            • memory/224-143-0x00000000055B0000-0x0000000005616000-memory.dmp

              Filesize

              408KB

            • memory/224-144-0x0000000005620000-0x0000000005686000-memory.dmp

              Filesize

              408KB

            • memory/224-145-0x0000000005CB0000-0x0000000005CCE000-memory.dmp

              Filesize

              120KB

            • memory/224-146-0x00000000072F0000-0x000000000796A000-memory.dmp

              Filesize

              6.5MB

            • memory/224-147-0x00000000061D0000-0x00000000061EA000-memory.dmp

              Filesize

              104KB

            • memory/224-142-0x0000000004E80000-0x00000000054A8000-memory.dmp

              Filesize

              6.2MB

            • memory/628-139-0x0000000005CA0000-0x0000000005CC2000-memory.dmp

              Filesize

              136KB

            • memory/628-138-0x0000000000C50000-0x00000000013C4000-memory.dmp

              Filesize

              7.5MB

            • memory/1948-157-0x0000000000400000-0x0000000000731000-memory.dmp

              Filesize

              3.2MB

            • memory/1948-154-0x0000000000400000-0x0000000000731000-memory.dmp

              Filesize

              3.2MB

            • memory/1948-158-0x0000000000400000-0x0000000000731000-memory.dmp

              Filesize

              3.2MB

            • memory/4644-164-0x00000000069B0000-0x00000000069CE000-memory.dmp

              Filesize

              120KB

            • memory/4644-166-0x00000000077F0000-0x00000000077FA000-memory.dmp

              Filesize

              40KB

            • memory/4644-163-0x0000000073840000-0x000000007388C000-memory.dmp

              Filesize

              304KB

            • memory/4644-168-0x0000000007A40000-0x0000000007AD6000-memory.dmp

              Filesize

              600KB

            • memory/4644-162-0x0000000007430000-0x0000000007462000-memory.dmp

              Filesize

              200KB

            We care about your privacy.

            This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.