aurora | aa349ad45bb48e85b5cd1b55308ae835353859219f28ece9685c8ae552e8e63a

General

Target

python-3.11.2.exe
Size

307.5MB
MD5

46dcfe95ce4b04837cd93d684e926a51
SHA1

77949607ef3908fa2feda27e8ec39c21779ef041
SHA256

aa349ad45bb48e85b5cd1b55308ae835353859219f28ece9685c8ae552e8e63a
SHA512

4961a0224d6e1f8b7f3126f1a2650ebc3685ca1ca2c3399a03db57243605e21be382e485dc0638cce7a1aa27f6f67669e7d2b2f8823687eb0c566df2ccaefa2e
SSDEEP

24576:hn5q0CD6pcOb0QjwRdPmXCcXTM0jzRsE8IpZujAp/7TniOe63GpF+1A4U4aPTx0j:Tq0CDscLQjwXmXCdgk+lKaDgF1z1M

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

C2

185.106.93.135:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Suspicious use of SetThreadContext 1 IoCs

Processes:

python-3.11.2.exe

description pid process target process

PID 1708 set thread context of 936 1708 python-3.11.2.exe python-3.11.2.exe

description	pid	process	target process
PID 1708 set thread context of 936	1708	python-3.11.2.exe	python-3.11.2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE
Token: 33	1372	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1372	AUDIODG.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

python-3.11.2.exe

description	pid	process	target process
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe
PID 1708 wrote to memory of 936	1708	python-3.11.2.exe	python-3.11.2.exe

C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe
"C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe
"C:\Users\Admin\AppData\Local\Temp\python-3.11.2.exe"
2⤵
PID:936

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:772

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x578
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/936-54-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-55-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-56-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-57-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-62-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-61-0x000007FFFFFDE000-0x000007FFFFFDF000-memory.dmp

Filesize
4KB

Download
memory/936-60-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-59-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-58-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-65-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-66-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-64-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-67-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-68-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-69-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-70-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-71-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-72-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-73-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-74-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-75-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-76-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-77-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-78-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-79-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-80-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-81-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-82-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-83-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/936-84-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download

Analysis

Sharing