aurora | be393666930fcd6564cec396d8b9732f34f6fdb9cdbd2283f21723a060ddeff3

Analysis

max time kernel
23s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
26/02/2023, 09:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
innosetup-6.2.1.exe
Size 807.4MB
Sample230226-k96smsgc5w
SHA256 d5bb2d356876be75ddc3a2c26172acd352dac04c9b49eea6695b05b9ddba7495
MD5 0257fe004e87f99031fde2dcbec1f727
SHA1 e00a5c6d34d7bc6e9d663b88230d86de16abc8a1
SHA512 b6d81b126b39bb2eb3829eda0fc00eff25900c965a3a046cef63bf14f102c5480cff4c31482d93e63ae4779c73087f4541e8092597b85e73bb49973c3cfc412b
SSDEEP 24576:x94s6V9vqyQT0iAw7vyc6CD8aH465hV27+TYF5otaz4ihmfg0dGRX8N1f+2b39Yh:x9h6V9vq/AwryFCJCh1z1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora spyware stealer

Malware Config

Extracted

Family

aurora

94.142.138.71:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 904 set thread context of 1176	904	innosetup-6.2.1.exe	27

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	320	wmic.exe
Token: SeSecurityPrivilege	320	wmic.exe
Token: SeTakeOwnershipPrivilege	320	wmic.exe
Token: SeLoadDriverPrivilege	320	wmic.exe
Token: SeSystemProfilePrivilege	320	wmic.exe
Token: SeSystemtimePrivilege	320	wmic.exe
Token: SeProfSingleProcessPrivilege	320	wmic.exe
Token: SeIncBasePriorityPrivilege	320	wmic.exe
Token: SeCreatePagefilePrivilege	320	wmic.exe
Token: SeBackupPrivilege	320	wmic.exe
Token: SeRestorePrivilege	320	wmic.exe
Token: SeShutdownPrivilege	320	wmic.exe
Token: SeDebugPrivilege	320	wmic.exe
Token: SeSystemEnvironmentPrivilege	320	wmic.exe
Token: SeRemoteShutdownPrivilege	320	wmic.exe
Token: SeUndockPrivilege	320	wmic.exe
Token: SeManageVolumePrivilege	320	wmic.exe
Token: 33	320	wmic.exe
Token: 34	320	wmic.exe
Token: 35	320	wmic.exe
Token: SeIncreaseQuotaPrivilege	320	wmic.exe
Token: SeSecurityPrivilege	320	wmic.exe
Token: SeTakeOwnershipPrivilege	320	wmic.exe
Token: SeLoadDriverPrivilege	320	wmic.exe
Token: SeSystemProfilePrivilege	320	wmic.exe
Token: SeSystemtimePrivilege	320	wmic.exe
Token: SeProfSingleProcessPrivilege	320	wmic.exe
Token: SeIncBasePriorityPrivilege	320	wmic.exe
Token: SeCreatePagefilePrivilege	320	wmic.exe
Token: SeBackupPrivilege	320	wmic.exe
Token: SeRestorePrivilege	320	wmic.exe
Token: SeShutdownPrivilege	320	wmic.exe
Token: SeDebugPrivilege	320	wmic.exe
Token: SeSystemEnvironmentPrivilege	320	wmic.exe
Token: SeRemoteShutdownPrivilege	320	wmic.exe
Token: SeUndockPrivilege	320	wmic.exe
Token: SeManageVolumePrivilege	320	wmic.exe
Token: 33	320	wmic.exe
Token: 34	320	wmic.exe
Token: 35	320	wmic.exe
Token: SeIncreaseQuotaPrivilege	1436	WMIC.exe
Token: SeSecurityPrivilege	1436	WMIC.exe
Token: SeTakeOwnershipPrivilege	1436	WMIC.exe
Token: SeLoadDriverPrivilege	1436	WMIC.exe
Token: SeSystemProfilePrivilege	1436	WMIC.exe
Token: SeSystemtimePrivilege	1436	WMIC.exe
Token: SeProfSingleProcessPrivilege	1436	WMIC.exe
Token: SeIncBasePriorityPrivilege	1436	WMIC.exe
Token: SeCreatePagefilePrivilege	1436	WMIC.exe
Token: SeBackupPrivilege	1436	WMIC.exe
Token: SeRestorePrivilege	1436	WMIC.exe
Token: SeShutdownPrivilege	1436	WMIC.exe
Token: SeDebugPrivilege	1436	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1436	WMIC.exe
Token: SeRemoteShutdownPrivilege	1436	WMIC.exe
Token: SeUndockPrivilege	1436	WMIC.exe
Token: SeManageVolumePrivilege	1436	WMIC.exe
Token: 33	1436	WMIC.exe
Token: 34	1436	WMIC.exe
Token: 35	1436	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1436	WMIC.exe
Token: SeSecurityPrivilege	1436	WMIC.exe
Token: SeTakeOwnershipPrivilege	1436	WMIC.exe
Token: SeLoadDriverPrivilege	1436	WMIC.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 904 wrote to memory of 1176	904	innosetup-6.2.1.exe	27
PID 1176 wrote to memory of 320	1176	innosetup-6.2.1.exe	28
PID 1176 wrote to memory of 320	1176	innosetup-6.2.1.exe	28
PID 1176 wrote to memory of 320	1176	innosetup-6.2.1.exe	28
PID 1176 wrote to memory of 676	1176	innosetup-6.2.1.exe	31
PID 1176 wrote to memory of 676	1176	innosetup-6.2.1.exe	31
PID 1176 wrote to memory of 676	1176	innosetup-6.2.1.exe	31
PID 676 wrote to memory of 1436	676	cmd.exe	33
PID 676 wrote to memory of 1436	676	cmd.exe	33
PID 676 wrote to memory of 1436	676	cmd.exe	33
PID 1176 wrote to memory of 1300	1176	innosetup-6.2.1.exe	34
PID 1176 wrote to memory of 1300	1176	innosetup-6.2.1.exe	34
PID 1176 wrote to memory of 1300	1176	innosetup-6.2.1.exe	34
PID 1300 wrote to memory of 828	1300	cmd.exe	36
PID 1300 wrote to memory of 828	1300	cmd.exe	36
PID 1300 wrote to memory of 828	1300	cmd.exe	36

C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:904
- C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
  "C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\System32\Wbem\wmic.exe
    wmic os get Caption
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:320
- - C:\Windows\system32\cmd.exe
    cmd /C "wmic path win32_VideoController get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1436
- - C:\Windows\system32\cmd.exe
    cmd /C "wmic cpu get name"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic cpu get name
      4⤵
      PID:828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot

Path C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot
Size 71KB
SHA256 4fed2f4c33a3876390d8520f184062927aca8e0ce3538127de3a2f66ea856d91
MD5 e5e23f78017d1e6eddfc8480e1679ee4
SHA1 0667bd1b7129b105bd2c66ef6ad54c9648aec072
SHA512 b1260e7ba7ad6d5dd0daeabc5f7cc1fc7a2e9259092f8d70d3d9eed923ed8aa60adcce4c27e9cb20966d500ed59edaaba9570f01d6a84180f1fb83e7b5c20049
SSDEEP 1536:pXYk/Q/OccbxYiWU/vXyVOlgZiHGOM7nF+ABbauqzga:pXH/Q/6Zp/viVwg0GOM7Vza
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1176-62-0x000007FFFFFDD000-0x000007FFFFFDE000-memory.dmp

Download

memory/1176-66-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-57-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-58-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-59-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-60-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-61-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-54-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-56-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-63-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-65-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-67-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-68-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-70-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-69-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-71-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-55-0x0000000000400000-0x000000000075D000-memory.dmp

Download

memory/1176-103-0x0000000000400000-0x000000000075D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads