Analysis

  • max time kernel
    153s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-02-2023 20:04

General

  • Target

    ChromiumUpdater.exe

  • Size

    800.0MB

  • MD5

    08cdb070611396e11631d07d8edffa5e

  • SHA1

    f335b698268881904bbe2eceb6e24354de2a08ad

  • SHA256

    1eb1fd9face0a477e82e40f2e18cd9d305202d69f2830ecbdfe8299ba8d391b5

  • SHA512

    6637484723ac59f09abbdc747657aa0d7271a54812a44166bbb70017de6a75c3a0568f6202df6d296ae8c94cd7715950c9976905b9072fbb66828c53ea0d3c7d

  • SSDEEP

    49152:mtnc2azvgRILo/tSXD+xMCuBoYdo0U5LJi0UaccLLK/nz9UlT5+07+d/VJRnpHJy:YWzo+0/0XiMCCzU5LJdoMC9w407+VR9

Score
10/10

Malware Config

Extracted

Family

aurora

C2

77.91.124.12:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe
    "C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe"
    1⤵
    • Checks BIOS information in registry
    PID:4980

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4980-133-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-134-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-135-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-136-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-137-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-138-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-139-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-140-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-141-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-142-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-143-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-144-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-145-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-146-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-147-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-148-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB

  • memory/4980-149-0x0000000000A90000-0x00000000013A2000-memory.dmp

    Filesize

    9.1MB