Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    21-02-2023 20:04

General

  • Target

    ChromiumUpdater.exe

  • Size

    800.0MB

  • MD5

    08cdb070611396e11631d07d8edffa5e

  • SHA1

    f335b698268881904bbe2eceb6e24354de2a08ad

  • SHA256

    1eb1fd9face0a477e82e40f2e18cd9d305202d69f2830ecbdfe8299ba8d391b5

  • SHA512

    6637484723ac59f09abbdc747657aa0d7271a54812a44166bbb70017de6a75c3a0568f6202df6d296ae8c94cd7715950c9976905b9072fbb66828c53ea0d3c7d

  • SSDEEP

    49152:mtnc2azvgRILo/tSXD+xMCuBoYdo0U5LJi0UaccLLK/nz9UlT5+07+d/VJRnpHJy:YWzo+0/0XiMCCzU5LJdoMC9w407+VR9

Score
10/10

Malware Config

Extracted

Family

aurora

C2

77.91.124.12:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe
    "C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe"
    1⤵
    • Checks BIOS information in registry
    PID:824

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/824-54-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-55-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-56-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-57-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-58-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-59-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-60-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-61-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-62-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-63-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-64-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-65-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-66-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-67-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-68-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB

  • memory/824-69-0x0000000001150000-0x0000000001A62000-memory.dmp

    Filesize

    9.1MB