aurora | aa349ad45bb48e85b5cd1b55308ae835353859219f28ece9685c8ae552e8e63a

Analysis

max time kernel
154s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2023 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

python-3.11.2.exe
Size

307.5MB
MD5

46dcfe95ce4b04837cd93d684e926a51
SHA1

77949607ef3908fa2feda27e8ec39c21779ef041
SHA256

aa349ad45bb48e85b5cd1b55308ae835353859219f28ece9685c8ae552e8e63a
SHA512

4961a0224d6e1f8b7f3126f1a2650ebc3685ca1ca2c3399a03db57243605e21be382e485dc0638cce7a1aa27f6f67669e7d2b2f8823687eb0c566df2ccaefa2e
SSDEEP

24576:hn5q0CD6pcOb0QjwRdPmXCcXTM0jzRsE8IpZujAp/7TniOe63GpF+1A4U4aPTx0j:Tq0CDscLQjwXmXCdgk+lKaDgF1z1M

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

185.106.93.135:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Suspicious use of SetThreadContext 1 IoCs

Processes:

python-3.11.2.exe

description pid process target process

PID 5016 set thread context of 5044 5016 python-3.11.2.exe python-3.11.2.exe

description	pid	process	target process
PID 5016 set thread context of 5044	5016	python-3.11.2.exe	python-3.11.2.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

python-3.11.2.exe

description	pid	process	target process
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe
PID 5016 wrote to memory of 5044	5016	python-3.11.2.exe	python-3.11.2.exe

C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe
"C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5016

C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe
"C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"
2⤵
PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-133-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-138-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-143-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-144-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-145-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-146-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-147-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-148-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-149-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-150-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-151-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-152-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-153-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-154-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-155-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-156-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-157-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-158-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-159-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-160-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download
memory/5044-161-0x00000000006F0000-0x0000000000A4C000-memory.dmp

Filesize
3.4MB

Download