aurora | 471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05-02-2023 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Size

3.6MB
MD5

36fd273ea7607d3a203f257f4e2649ed
SHA1

5e243f79ecb539d0d1f75fce7ddfedeccee70a48
SHA256

471d501162e2a5cb6aab3f4f5362ff843d05ef9f20d9fd7ea29733d3a9875747
SHA512

cf81163bc6d1f1141130fbe70944387b97d322afe837ad21a88a0be8f9fd87615bd7022cc572b1783871cc99f224258bae75855e805c733793b723ba0483597d
SSDEEP

98304:VQF9SqUKUehGS26Ish7MUTjA+1VFnqWXvqaY4:VSSzMGS26x1MUTM+/Fh

Score

10^/10

aurora persistence stealer

Malware Config

Extracted

Family

aurora

45.9.74.11:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

voiceadequovl.exevoiceadequovl.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	voiceadequovl.exe

Executes dropped EXE 6 IoCs

Processes:

voiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exevoiceadequovl.exe

pid process

4280 voiceadequovl.exe
4092 voiceadequovl.exe
4536 voiceadequovl.exe
956 voiceadequovl.exe
1172 voiceadequovl.exe
2540 voiceadequovl.exe

pid	process
4280	voiceadequovl.exe
4092	voiceadequovl.exe
4536	voiceadequovl.exe
956	voiceadequovl.exe
1172	voiceadequovl.exe
2540	voiceadequovl.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exevoiceadequovl.exepowershell.exe

pid	process
3728	powershell.exe
3728	powershell.exe
4092	voiceadequovl.exe
4092	voiceadequovl.exe
4092	voiceadequovl.exe
4092	voiceadequovl.exe
4092	voiceadequovl.exe
4092	voiceadequovl.exe
2028	powershell.exe
4092	voiceadequovl.exe
4092	voiceadequovl.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

voiceadequovl.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4092 voiceadequovl.exe
Token: SeDebugPrivilege 3728 powershell.exe
Token: SeDebugPrivilege 2028 powershell.exe

description	pid	process
Token: SeDebugPrivilege	4092	voiceadequovl.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exevoiceadequovl.exevoiceadequovl.execmd.exe

description	pid	process	target process
PID 3460 wrote to memory of 4280	3460	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 3460 wrote to memory of 4280	3460	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 3460 wrote to memory of 4280	3460	5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe	voiceadequovl.exe
PID 4280 wrote to memory of 4092	4280	voiceadequovl.exe	voiceadequovl.exe
PID 4280 wrote to memory of 4092	4280	voiceadequovl.exe	voiceadequovl.exe
PID 4280 wrote to memory of 4092	4280	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 3728	4092	voiceadequovl.exe	powershell.exe
PID 4092 wrote to memory of 3728	4092	voiceadequovl.exe	powershell.exe
PID 4092 wrote to memory of 3728	4092	voiceadequovl.exe	powershell.exe
PID 4092 wrote to memory of 4468	4092	voiceadequovl.exe	cmd.exe
PID 4092 wrote to memory of 4468	4092	voiceadequovl.exe	cmd.exe
PID 4092 wrote to memory of 4468	4092	voiceadequovl.exe	cmd.exe
PID 4468 wrote to memory of 2028	4468	cmd.exe	powershell.exe
PID 4468 wrote to memory of 2028	4468	cmd.exe	powershell.exe
PID 4468 wrote to memory of 2028	4468	cmd.exe	powershell.exe
PID 4092 wrote to memory of 4536	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 4536	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 4536	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 956	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 956	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 956	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 1172	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 1172	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 1172	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 2540	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 2540	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 2540	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 960	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 960	4092	voiceadequovl.exe	voiceadequovl.exe
PID 4092 wrote to memory of 960	4092	voiceadequovl.exe	voiceadequovl.exe

C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe
"C:\Users\Admin\AppData\Local\Temp\5e243f79ecb539d0d1f75fce7ddfedeccee70a48.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3460

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
"C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
4⤵
- Suspicious use of WriteProcessMemory
PID:4468

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -ENC cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AZQB4AGMAbAB1AHMAaQBvAG4AcABhAHQAaAAgAEMAOgBcAA==
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
PID:4536

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
PID:956

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
PID:1172

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
PID:960

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
PID:4252

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
5⤵
PID:3192

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
5⤵
PID:4500

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
6⤵
PID:4508

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
5⤵
PID:2480

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
6⤵
PID:1800

C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
4⤵
- Executes dropped EXE
PID:2540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
402af14a54d868a5f546f9443190af7f

SHA1
f17064903551de86edb00ef17ae4c0302c213c21

SHA256
ab551cf016c5df119575f3c956f30d772e21a5107c9c6990c5a9749efa7d9f0e

SHA512
a7e05686bc3e1b96a984541e77a39614086fb043b7bfe91099d43916c5b57e584f8d954500e6158493b34907e9dcec0ce31851e57578239c1e072119dd57677c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\voiceadequovl.exe
Filesize
365.5MB

MD5
ba50f2bca86ba947a8d2035bb9b35123

SHA1
a542b5c5d41174dc2475a219978123b7d14f958f

SHA256
17790c5c071280462ed8e617fd2edfff5bf0f40fb9add57f866f058fdbf24cb5

SHA512
08fdb619e411247c571710bc47df2463c95dc2fee82025e548b65ff1a3e4a53e663fafec9bcc5cc234f32211b25f6f9472786c1be543eb71629f32ec09f04379

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
369.8MB

MD5
14a9737eb666769fee7c28a00eb14e82

SHA1
ab8f2279f13a546fc32233a4da0855660fb07ec0

SHA256
a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a

SHA512
973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
369.8MB

MD5
14a9737eb666769fee7c28a00eb14e82

SHA1
ab8f2279f13a546fc32233a4da0855660fb07ec0

SHA256
a5fda7973fc4b9cf7fa14943302c0b6cd81c7615105ab0031e20fc5ed2a2396a

SHA512
973d5236da1979d31376d55f6b304fa166835d99a4574e3345e25ebed5b492cf9a3ae3f0a800d137fa8756288684b6d5c07ff97c8e5c2cbb698585f09373e9e7

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
39.0MB

MD5
4c976ed646698096d43cf40fd033af7b

SHA1
51bca38b77ea5aa7651813f9b1682b8c673bf972

SHA256
c3bb7c8ced315b819fe6e99b89c6427ba35902bd52dc8483985eef5471796ea5

SHA512
fac03b2fca42aeb77a9ebb1bf5caec384b4545b025305eecb0fcb2cdeedfab2b887a0e3fe4050ea42343b517c82361c03a37be8e80c2cf66deec3187683f34ba

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
38.4MB

MD5
7237374e8e0509e92b908ea3a426f4ba

SHA1
1d28ade53812b241587c8f0363b151d307f0f87b

SHA256
ce4ca8c51c1600cd87e6f01d48c73d3c759c2c5372b2ad96e272a52bff46347e

SHA512
f8f06f0227c37ffc1481969aa3bbfccaac3da9097c7ee8e58ef09c44830e62f2785597f6ef75c9f49b58882e1a0b5c0a6ec098ac3a36810f53c89a7f49e54a6d

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
37.8MB

MD5
faad2b07da6e85958ea504d38d2273cc

SHA1
006ae0dde3ea76f0c6d528f6f01038f7a0958d02

SHA256
b94e0f8fc03f628743237fb0afd938294ce173ac49dd3be52c4f526ad93bbe29

SHA512
8ea953250823561f1ce2db6b9d989054af3f8915f69592820aece79a545c51e03e7a9e928962a698bf23622a2c2380fc8b199c8a16b352f5aacb15850028b71e

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
37.0MB

MD5
535cfbb1f6798a776277008b740cf790

SHA1
ee1d3ea40dd986dfe016caa5b916babb5afca4ef

SHA256
a71eaa6b524c8df1574db3fc24e11a8e6a99325573e3a55da660d609b5ce7962

SHA512
ee3066fa541a025114ad8a0afa547dc97de81099f0978e6089605cee45a082f43b3eb82b3dddff66bd8204f30a138456eb8dccdeb5e82bf5e6b975c5598f3908

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
37.4MB

MD5
1e8c89f803c13b0dd117e12f3c1bfada

SHA1
43e62bea3931689d8dfb7abc044261a97dd3424f

SHA256
d5c6942a88fcf08a511f0ce6bf68812ecd30c35fa760289a6f61b55726b1cab1

SHA512
0203267ddcecd2a7caa554feceb7be2501e793ba34085b7b9249877e589da53872129c30e473a15899004667121fac1d5be817847c3d01d69f19f47be7929281

Download Submit
C:\Users\Admin\AppData\Roaming\Voice\voiceadequovl.exe
Filesize
36.8MB

MD5
82424df15a62ae7ba2f32489ebdfff4a

SHA1
91355cd77d7a73dd7e2e23f675b681c8b1ceb725

SHA256
b3310adbef89836f5601a42cc946bdbfbb708982e261d107bf3ac325b7953af3

SHA512
91889f762f13d89aab3e9dcc1202aa6573433460bea3d7b3708b18a450e871033b4239239bf251c3dc316b8c90800e596506045926c6ff76c107dfc32810e5ee

Download Submit
memory/956-153-0x0000000000000000-mapping.dmp

Download
memory/960-159-0x0000000000000000-mapping.dmp

Download
memory/1172-155-0x0000000000000000-mapping.dmp

Download
memory/1800-177-0x0000000000000000-mapping.dmp

Download
memory/2028-170-0x00000000065D0000-0x0000000006602000-memory.dmp

Filesize
200KB

Download
memory/2028-181-0x00000000075D0000-0x00000000075D8000-memory.dmp

Filesize
32KB

Download
memory/2028-180-0x00000000075F0000-0x000000000760A000-memory.dmp

Filesize
104KB

Download
memory/2028-179-0x0000000005F20000-0x0000000005F2E000-memory.dmp

Filesize
56KB

Download
memory/2028-178-0x0000000007690000-0x0000000007726000-memory.dmp

Filesize
600KB

Download
memory/2028-175-0x0000000007440000-0x000000000744A000-memory.dmp

Filesize
40KB

Download
memory/2028-149-0x0000000000000000-mapping.dmp

Download
memory/2028-172-0x00000000065B0000-0x00000000065CE000-memory.dmp

Filesize
120KB

Download
memory/2028-171-0x0000000073B40000-0x0000000073B8C000-memory.dmp

Filesize
304KB

Download
memory/2480-176-0x0000000000000000-mapping.dmp

Download
memory/2540-157-0x0000000000000000-mapping.dmp

Download
memory/3192-168-0x0000000000000000-mapping.dmp

Download
memory/3728-143-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/3728-144-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Filesize
408KB

Download
memory/3728-147-0x00000000068F0000-0x000000000690A000-memory.dmp

Filesize
104KB

Download
memory/3728-146-0x0000000007C30000-0x00000000082AA000-memory.dmp

Filesize
6.5MB

Download
memory/3728-140-0x0000000000000000-mapping.dmp

Download
memory/3728-145-0x00000000063F0000-0x000000000640E000-memory.dmp

Filesize
120KB

Download
memory/3728-141-0x0000000002B20000-0x0000000002B56000-memory.dmp

Filesize
216KB

Download
memory/3728-142-0x00000000056B0000-0x0000000005CD8000-memory.dmp

Filesize
6.2MB

Download
memory/4092-135-0x0000000000000000-mapping.dmp

Download
memory/4092-139-0x0000000005DA0000-0x0000000005DC2000-memory.dmp

Filesize
136KB

Download
memory/4092-138-0x0000000000D20000-0x0000000001494000-memory.dmp

Filesize
7.5MB

Download
memory/4252-161-0x0000000000000000-mapping.dmp

Download
memory/4252-166-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4252-162-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4252-165-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4252-182-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/4280-132-0x0000000000000000-mapping.dmp

Download
memory/4468-148-0x0000000000000000-mapping.dmp

Download
memory/4500-173-0x0000000000000000-mapping.dmp

Download
memory/4508-174-0x0000000000000000-mapping.dmp

Download
memory/4536-151-0x0000000000000000-mapping.dmp

Download