aurora | cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707

General

Target

Installer.exe
Size

7.5MB
MD5

b2c713fe8dbaea840c00afd0f67f1d9d
SHA1

036dab17619a4ca6e1036d99b68b10aea5872968
SHA256

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707
SHA512

03276046a65a6fda948f63d3e5bb7d4466ff2933677c0f847f927d50b04f3d1600d3c7e5fc905f6a54f2de9fdedc46326d39c160ff37d3a4cd874d20f01cef18
SSDEEP

24576:24wquL3a5sUcuADwRSP5C5AG1yO80IpNKF7r1IlP6jBktGr4ICqJIJFTWjiQWdtC:CquL38soADw45Ccgk+lKCtoPEz1b

Score

10^/10

aurora spyware stealer

Malware Config

Extracted

Family

aurora

C2

94.142.138.29:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

Installer.exe

description pid process target process

PID 1044 set thread context of 2036 1044 Installer.exe Installer.exe

description	pid	process	target process
PID 1044 set thread context of 2036	1044	Installer.exe	Installer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	1404	wmic.exe
Token: SeSecurityPrivilege	1404	wmic.exe
Token: SeTakeOwnershipPrivilege	1404	wmic.exe
Token: SeLoadDriverPrivilege	1404	wmic.exe
Token: SeSystemProfilePrivilege	1404	wmic.exe
Token: SeSystemtimePrivilege	1404	wmic.exe
Token: SeProfSingleProcessPrivilege	1404	wmic.exe
Token: SeIncBasePriorityPrivilege	1404	wmic.exe
Token: SeCreatePagefilePrivilege	1404	wmic.exe
Token: SeBackupPrivilege	1404	wmic.exe
Token: SeRestorePrivilege	1404	wmic.exe
Token: SeShutdownPrivilege	1404	wmic.exe
Token: SeDebugPrivilege	1404	wmic.exe
Token: SeSystemEnvironmentPrivilege	1404	wmic.exe
Token: SeRemoteShutdownPrivilege	1404	wmic.exe
Token: SeUndockPrivilege	1404	wmic.exe
Token: SeManageVolumePrivilege	1404	wmic.exe
Token: 33	1404	wmic.exe
Token: 34	1404	wmic.exe
Token: 35	1404	wmic.exe
Token: SeIncreaseQuotaPrivilege	1404	wmic.exe
Token: SeSecurityPrivilege	1404	wmic.exe
Token: SeTakeOwnershipPrivilege	1404	wmic.exe
Token: SeLoadDriverPrivilege	1404	wmic.exe
Token: SeSystemProfilePrivilege	1404	wmic.exe
Token: SeSystemtimePrivilege	1404	wmic.exe
Token: SeProfSingleProcessPrivilege	1404	wmic.exe
Token: SeIncBasePriorityPrivilege	1404	wmic.exe
Token: SeCreatePagefilePrivilege	1404	wmic.exe
Token: SeBackupPrivilege	1404	wmic.exe
Token: SeRestorePrivilege	1404	wmic.exe
Token: SeShutdownPrivilege	1404	wmic.exe
Token: SeDebugPrivilege	1404	wmic.exe
Token: SeSystemEnvironmentPrivilege	1404	wmic.exe
Token: SeRemoteShutdownPrivilege	1404	wmic.exe
Token: SeUndockPrivilege	1404	wmic.exe
Token: SeManageVolumePrivilege	1404	wmic.exe
Token: 33	1404	wmic.exe
Token: 34	1404	wmic.exe
Token: 35	1404	wmic.exe
Token: SeIncreaseQuotaPrivilege	860	WMIC.exe
Token: SeSecurityPrivilege	860	WMIC.exe
Token: SeTakeOwnershipPrivilege	860	WMIC.exe
Token: SeLoadDriverPrivilege	860	WMIC.exe
Token: SeSystemProfilePrivilege	860	WMIC.exe
Token: SeSystemtimePrivilege	860	WMIC.exe
Token: SeProfSingleProcessPrivilege	860	WMIC.exe
Token: SeIncBasePriorityPrivilege	860	WMIC.exe
Token: SeCreatePagefilePrivilege	860	WMIC.exe
Token: SeBackupPrivilege	860	WMIC.exe
Token: SeRestorePrivilege	860	WMIC.exe
Token: SeShutdownPrivilege	860	WMIC.exe
Token: SeDebugPrivilege	860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	860	WMIC.exe
Token: SeRemoteShutdownPrivilege	860	WMIC.exe
Token: SeUndockPrivilege	860	WMIC.exe
Token: SeManageVolumePrivilege	860	WMIC.exe
Token: 33	860	WMIC.exe
Token: 34	860	WMIC.exe
Token: 35	860	WMIC.exe
Token: SeIncreaseQuotaPrivilege	860	WMIC.exe
Token: SeSecurityPrivilege	860	WMIC.exe
Token: SeTakeOwnershipPrivilege	860	WMIC.exe
Token: SeLoadDriverPrivilege	860	WMIC.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

Installer.exeInstaller.execmd.execmd.exe

description	pid	process	target process
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 1044 wrote to memory of 2036	1044	Installer.exe	Installer.exe
PID 2036 wrote to memory of 1404	2036	Installer.exe	wmic.exe
PID 2036 wrote to memory of 1404	2036	Installer.exe	wmic.exe
PID 2036 wrote to memory of 1404	2036	Installer.exe	wmic.exe
PID 2036 wrote to memory of 336	2036	Installer.exe	cmd.exe
PID 2036 wrote to memory of 336	2036	Installer.exe	cmd.exe
PID 2036 wrote to memory of 336	2036	Installer.exe	cmd.exe
PID 336 wrote to memory of 860	336	cmd.exe	WMIC.exe
PID 336 wrote to memory of 860	336	cmd.exe	WMIC.exe
PID 336 wrote to memory of 860	336	cmd.exe	WMIC.exe
PID 2036 wrote to memory of 748	2036	Installer.exe	cmd.exe
PID 2036 wrote to memory of 748	2036	Installer.exe	cmd.exe
PID 2036 wrote to memory of 748	2036	Installer.exe	cmd.exe
PID 748 wrote to memory of 1976	748	cmd.exe	WMIC.exe
PID 748 wrote to memory of 1976	748	cmd.exe	WMIC.exe
PID 748 wrote to memory of 1976	748	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1044

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\System32\Wbem\wmic.exe
wmic os get Caption
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:860

C:\Windows\system32\cmd.exe
cmd /C "wmic cpu get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:748

C:\Windows\System32\Wbem\WMIC.exe
wmic cpu get name
4⤵
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-71-0x0000000000000000-mapping.dmp

Download
memory/748-73-0x0000000000000000-mapping.dmp

Download
memory/860-72-0x0000000000000000-mapping.dmp

Download
memory/1404-70-0x0000000000000000-mapping.dmp

Download
memory/1976-74-0x0000000000000000-mapping.dmp

Download
memory/2036-61-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-64-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-65-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-68-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-66-0x0000000000464C40-mapping.dmp

Download
memory/2036-69-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-62-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-54-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-59-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-57-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-55-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2036-75-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download

Resubmissions

Analysis

Sharing