Overview

overview

10

Static

static

1

474301aa22...8e.exe

windows7-x64

10

474301aa22...8e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe

  • Size

    626KB

  • Sample

    230222-jax6saca8z

  • MD5

    47b01695ff80b03ae518b333163da42c

  • SHA1

    aa95d6c08ae9201828da23593e42df4a2e39ce82

  • SHA256

    474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e

  • SHA512

    886a285e76a7d41e14bb1cfef3a464dc47e4b665bfd6905f26961253fd5f4eee0a6fed01afd464d603c8d17f6d09edc475e2fdd4da79178c6be0f54dc5bad466

  • SSDEEP

    6144:fMEN1L7wFSXZX4KipZx7fuwkBzvGwxAOo8jRfAAfc:f9N1LkFSJX45p3Uhq8jRAAE

Score
10/10
auroraevasionspywarestealer

Malware Config

Extracted

Family

aurora

C2

107.182.129.73:8081

Targets

    • Target

      474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e.exe

    • Size

      626KB

    • MD5

      47b01695ff80b03ae518b333163da42c

    • SHA1

      aa95d6c08ae9201828da23593e42df4a2e39ce82

    • SHA256

      474301aa2294450d6e60ae07824076744bccc4b2603a03cee01de3b4dbada38e

    • SHA512

      886a285e76a7d41e14bb1cfef3a464dc47e4b665bfd6905f26961253fd5f4eee0a6fed01afd464d603c8d17f6d09edc475e2fdd4da79178c6be0f54dc5bad466

    • SSDEEP

      6144:fMEN1L7wFSXZX4KipZx7fuwkBzvGwxAOo8jRfAAfc:f9N1LkFSJX45p3Uhq8jRAAE

    Score
    10/10
    auroraevasionspywarestealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Modifies security service

      evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Scripting

1
T1064

Credential Access

Credentials in Files

2
T1081

Discovery

System Information Discovery

1
T1082

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Service Stop

1
T1489

Tasks