Malware Analysis Report

2024-11-30 23:16

Sample ID 230226-lerkxage45
Target innosetup-6.2.1.exe
SHA256 40a3561b321f01b715274144fb75d79e4d3437cf10dcee86818b9a02f8849d20
Tags
aurora stealer spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

40a3561b321f01b715274144fb75d79e4d3437cf10dcee86818b9a02f8849d20

Threat Level: Known bad

The file innosetup-6.2.1.exe was found to be: Known bad.

Malicious Activity Summary

aurora stealer spyware

Aurora

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Suspicious use of SetThreadContext

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-02-26 09:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-02-26 09:27

Reported

2023-02-26 09:29

Platform

win7-20230220-en

Max time kernel

31s

Max time network

34s

Command Line

"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"

Signatures

Aurora

stealer aurora

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1992 set thread context of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 1992 wrote to memory of 1756 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe

"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"

C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe

"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"

Network

Country Destination Domain Proto
NL 94.142.138.71:8081 tcp

Files

memory/1756-54-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-55-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-56-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-57-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-58-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-59-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-60-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-61-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-62-0x000007FFFFFDE000-0x000007FFFFFDF000-memory.dmp

memory/1756-63-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-65-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-66-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-67-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-68-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-69-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-70-0x0000000000400000-0x000000000075D000-memory.dmp

memory/1756-71-0x0000000000400000-0x000000000075D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-02-26 09:27

Reported

2023-02-26 09:29

Platform

win10v2004-20230220-en

Max time kernel

55s

Max time network

73s

Command Line

"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"

Signatures

Aurora

stealer aurora

Reads user/profile data of web browsers

spyware stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3816 set thread context of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 3816 wrote to memory of 2080 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe
PID 2080 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Windows\System32\Wbem\wmic.exe
PID 2080 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Windows\System32\Wbem\wmic.exe
PID 2080 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 2384 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Windows\system32\cmd.exe
PID 2384 wrote to memory of 4340 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2384 wrote to memory of 4340 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 2080 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Windows\system32\cmd.exe
PID 2080 wrote to memory of 4696 N/A C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe C:\Windows\system32\cmd.exe
PID 4696 wrote to memory of 100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4696 wrote to memory of 100 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe

Processes

C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe

"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"

C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe

"C:\Users\Admin\AppData\Local\Temp\innosetup-6.2.1.exe"

C:\Windows\System32\Wbem\wmic.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

cmd /C "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

cmd /C "wmic cpu get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic cpu get name

Network

Country Destination Domain Proto
US 8.8.8.8:53 199.176.139.52.in-addr.arpa udp
NL 94.142.138.71:8081 tcp
US 8.8.8.8:53 71.138.142.94.in-addr.arpa udp
IE 20.54.89.15:443 tcp
US 8.8.8.8:53 151.122.125.40.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 86.8.109.52.in-addr.arpa udp

Files

memory/2080-133-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-139-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-145-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-146-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-147-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-148-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-149-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-150-0x0000000000440000-0x000000000079D000-memory.dmp

memory/2080-151-0x0000000000440000-0x000000000079D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

MD5 53bf804f75123ed2339305be1d298398
SHA1 33a337e3e219da8ecd237b44fbcaf4864124a012
SHA256 7d6155b8b6c9a78a70af6be7df47f1dac5f40215f4a6ae431d1ee27c021888f8
SHA512 7611c75031b77b6098f1e70c1b27e0a95f259616f8b2f8acc734e371998badf321c10c9fb8669d61615673f0fb65787f0398966bda38cd430e009c83df00e16e

C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL

MD5 b2446d155f77cf70a33bb0c25172fa3f
SHA1 c20d68dad9e872b4607a5677c4851f863c28daf7
SHA256 0faba9ea9b88b2982372c66b2eea8d6a5d99fc565c37db53ba6a4075619cfffb
SHA512 5d38e78c38f64a989570b431f7d2ef660c0678b3dc25baf3244499308535492de861a244e262720e36eeb4f8127eca62679c0b0383350c302783246191e82654

memory/2080-204-0x0000000000440000-0x000000000079D000-memory.dmp