Analysis
- max time kernel
153s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
21/02/2023, 20:04
General
- Target ChromiumUpdater.exe
- Size 800.0MB
- Sample230221-yteacagc95
- SHA256 1eb1fd9face0a477e82e40f2e18cd9d305202d69f2830ecbdfe8299ba8d391b5
Malware Config
Extracted
-
aurora
-
77.91.124.12:8081
Signatures
- Aurora
Aurora is a crypto wallet stealer written in Golang.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe"C:\Users\Admin\AppData\Local\Temp\ChromiumUpdater.exe"1⤵
- Checks BIOS information in registry
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4980-133-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-134-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-135-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-136-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-137-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-138-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-139-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-140-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-141-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-142-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-143-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-144-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-145-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-146-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-147-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-148-0x0000000000A90000-0x00000000013A2000-memory.dmp
memory/4980-149-0x0000000000A90000-0x00000000013A2000-memory.dmp