aurora | be393666930fcd6564cec396d8b9732f34f6fdb9cdbd2283f21723a060ddeff3

Analysis

max time kernel
56s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-02-2023 09:19

Target

innosetup-6.2.1.exe
Size

807.4MB
MD5

0257fe004e87f99031fde2dcbec1f727
SHA1

e00a5c6d34d7bc6e9d663b88230d86de16abc8a1
SHA256

d5bb2d356876be75ddc3a2c26172acd352dac04c9b49eea6695b05b9ddba7495
SHA512

b6d81b126b39bb2eb3829eda0fc00eff25900c965a3a046cef63bf14f102c5480cff4c31482d93e63ae4779c73087f4541e8092597b85e73bb49973c3cfc412b
SSDEEP

24576:x94s6V9vqyQT0iAw7vyc6CD8aH465hV27+TYF5otaz4ihmfg0dGRX8N1f+2b39Yh:x9h6V9vq/AwryFCJCh1z1

Score

10^/10

aurora stealer

Family

aurora

94.142.138.71:8081

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Suspicious use of SetThreadContext 1 IoCs

Processes:

innosetup-6.2.1.exe

description pid process target process

PID 4432 set thread context of 1028 4432 innosetup-6.2.1.exe innosetup-6.2.1.exe

description	pid	process	target process
PID 4432 set thread context of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

innosetup-6.2.1.exe

description	pid	process	target process
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe
PID 4432 wrote to memory of 1028	4432	innosetup-6.2.1.exe	innosetup-6.2.1.exe

C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"
2⤵
PID:1028

memory/1028-133-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download
memory/1028-139-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download
memory/1028-145-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download
memory/1028-146-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download
memory/1028-147-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download
memory/1028-148-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download
memory/1028-149-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download
memory/1028-150-0x0000000000EA0000-0x00000000011FD000-memory.dmp

Filesize
3.4MB

Download