aurora | 51b8e08571ddd7d98f4da91561999fce1b454ea42b3b83655f207df77f02ae1d

General

Target

tmp.exe
Size

6.2MB
MD5

9b34a1a535c29e31915e4b8993d9bb5e
SHA1

3801b45b01a1ddc836a10f9a4e28bb368bc958de
SHA256

51b8e08571ddd7d98f4da91561999fce1b454ea42b3b83655f207df77f02ae1d
SHA512

0701c9d84a14077fa5bb2a29abef21d1c67a36bedc6e4a9d0d50b6cb336d9c56ba0c0f823ecd6f31fd28847092bf3a2318f7dc3c1505ace26383523fb598dd09
SSDEEP

196608:ANOniBSEhRELqS/ohbK9iRs5Vb9sybbsx0rnsEniAd96:ANOniBSEhRELqS/ohW9iRs5Vb9sybbs9

Score

10^/10

aurora persistence spyware stealer

Malware Config

Extracted

Family

aurora

C2

94.142.138.112:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

meetrounov.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	meetrounov.exe

Executes dropped EXE 2 IoCs

Processes:

meetrounov.exemeetrounov.exe

pid process

1160 meetrounov.exe
2448 meetrounov.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1160	meetrounov.exe
2448	meetrounov.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

tmp.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	tmp.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	tmp.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

meetrounov.exe

description pid process target process

PID 1160 set thread context of 2448 1160 meetrounov.exe meetrounov.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

3176 powershell.exe
3176 powershell.exe

description	pid	process	target process
PID 1160 set thread context of 2448	1160	meetrounov.exe	meetrounov.exe

pid	process
3176	powershell.exe
3176	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

meetrounov.exepowershell.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1160	meetrounov.exe
Token: SeDebugPrivilege	3176	powershell.exe
Token: SeIncreaseQuotaPrivilege	1548	wmic.exe
Token: SeSecurityPrivilege	1548	wmic.exe
Token: SeTakeOwnershipPrivilege	1548	wmic.exe
Token: SeLoadDriverPrivilege	1548	wmic.exe
Token: SeSystemProfilePrivilege	1548	wmic.exe
Token: SeSystemtimePrivilege	1548	wmic.exe
Token: SeProfSingleProcessPrivilege	1548	wmic.exe
Token: SeIncBasePriorityPrivilege	1548	wmic.exe
Token: SeCreatePagefilePrivilege	1548	wmic.exe
Token: SeBackupPrivilege	1548	wmic.exe
Token: SeRestorePrivilege	1548	wmic.exe
Token: SeShutdownPrivilege	1548	wmic.exe
Token: SeDebugPrivilege	1548	wmic.exe
Token: SeSystemEnvironmentPrivilege	1548	wmic.exe
Token: SeRemoteShutdownPrivilege	1548	wmic.exe
Token: SeUndockPrivilege	1548	wmic.exe
Token: SeManageVolumePrivilege	1548	wmic.exe
Token: 33	1548	wmic.exe
Token: 34	1548	wmic.exe
Token: 35	1548	wmic.exe
Token: 36	1548	wmic.exe
Token: SeIncreaseQuotaPrivilege	1548	wmic.exe
Token: SeSecurityPrivilege	1548	wmic.exe
Token: SeTakeOwnershipPrivilege	1548	wmic.exe
Token: SeLoadDriverPrivilege	1548	wmic.exe
Token: SeSystemProfilePrivilege	1548	wmic.exe
Token: SeSystemtimePrivilege	1548	wmic.exe
Token: SeProfSingleProcessPrivilege	1548	wmic.exe
Token: SeIncBasePriorityPrivilege	1548	wmic.exe
Token: SeCreatePagefilePrivilege	1548	wmic.exe
Token: SeBackupPrivilege	1548	wmic.exe
Token: SeRestorePrivilege	1548	wmic.exe
Token: SeShutdownPrivilege	1548	wmic.exe
Token: SeDebugPrivilege	1548	wmic.exe
Token: SeSystemEnvironmentPrivilege	1548	wmic.exe
Token: SeRemoteShutdownPrivilege	1548	wmic.exe
Token: SeUndockPrivilege	1548	wmic.exe
Token: SeManageVolumePrivilege	1548	wmic.exe
Token: 33	1548	wmic.exe
Token: 34	1548	wmic.exe
Token: 35	1548	wmic.exe
Token: 36	1548	wmic.exe
Token: SeIncreaseQuotaPrivilege	3004	WMIC.exe
Token: SeSecurityPrivilege	3004	WMIC.exe
Token: SeTakeOwnershipPrivilege	3004	WMIC.exe
Token: SeLoadDriverPrivilege	3004	WMIC.exe
Token: SeSystemProfilePrivilege	3004	WMIC.exe
Token: SeSystemtimePrivilege	3004	WMIC.exe
Token: SeProfSingleProcessPrivilege	3004	WMIC.exe
Token: SeIncBasePriorityPrivilege	3004	WMIC.exe
Token: SeCreatePagefilePrivilege	3004	WMIC.exe
Token: SeBackupPrivilege	3004	WMIC.exe
Token: SeRestorePrivilege	3004	WMIC.exe
Token: SeShutdownPrivilege	3004	WMIC.exe
Token: SeDebugPrivilege	3004	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3004	WMIC.exe
Token: SeRemoteShutdownPrivilege	3004	WMIC.exe
Token: SeUndockPrivilege	3004	WMIC.exe
Token: SeManageVolumePrivilege	3004	WMIC.exe
Token: 33	3004	WMIC.exe
Token: 34	3004	WMIC.exe
Token: 35	3004	WMIC.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

tmp.exemeetrounov.exemeetrounov.execmd.execmd.exe

description	pid	process	target process
PID 4356 wrote to memory of 1160	4356	tmp.exe	meetrounov.exe
PID 4356 wrote to memory of 1160	4356	tmp.exe	meetrounov.exe
PID 4356 wrote to memory of 1160	4356	tmp.exe	meetrounov.exe
PID 1160 wrote to memory of 3176	1160	meetrounov.exe	powershell.exe
PID 1160 wrote to memory of 3176	1160	meetrounov.exe	powershell.exe
PID 1160 wrote to memory of 3176	1160	meetrounov.exe	powershell.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 1160 wrote to memory of 2448	1160	meetrounov.exe	meetrounov.exe
PID 2448 wrote to memory of 1548	2448	meetrounov.exe	wmic.exe
PID 2448 wrote to memory of 1548	2448	meetrounov.exe	wmic.exe
PID 2448 wrote to memory of 1548	2448	meetrounov.exe	wmic.exe
PID 2448 wrote to memory of 1252	2448	meetrounov.exe	cmd.exe
PID 2448 wrote to memory of 1252	2448	meetrounov.exe	cmd.exe
PID 2448 wrote to memory of 1252	2448	meetrounov.exe	cmd.exe
PID 1252 wrote to memory of 3004	1252	cmd.exe	WMIC.exe
PID 1252 wrote to memory of 3004	1252	cmd.exe	WMIC.exe
PID 1252 wrote to memory of 3004	1252	cmd.exe	WMIC.exe
PID 2448 wrote to memory of 4288	2448	meetrounov.exe	cmd.exe
PID 2448 wrote to memory of 4288	2448	meetrounov.exe	cmd.exe
PID 2448 wrote to memory of 4288	2448	meetrounov.exe	cmd.exe
PID 4288 wrote to memory of 5100	4288	cmd.exe	WMIC.exe
PID 4288 wrote to memory of 5100	4288	cmd.exe	WMIC.exe
PID 4288 wrote to memory of 5100	4288	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\meetrounov.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\meetrounov.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMwA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\meetrounov.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\meetrounov.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2448
  - - C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1548
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1252
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3004
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic cpu get name"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4288
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic cpu get name
        5⤵
        
        PID:5100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\meetrounov.exe

Filesize
366.1MB

MD5
0f1c71b32b79c69580a2047de48151d5

SHA1
21f5a5060f0681de7d77ad8ef5cac16c61569c92

SHA256
e9729112633b5e23b2cb67e0050129cbcab51bfadb34646f033707ec75f7fd98

SHA512
a1143e50f1deea80db9b39b6fcd8e65b4a38ddc7e01af6fa6af313f24ddfc715e83f61eeae2e04f37c5ab4560f346f7d3c360b6646deb29ff6cce5e716a38104

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\meetrounov.exe

Filesize
366.1MB

MD5
0f1c71b32b79c69580a2047de48151d5

SHA1
21f5a5060f0681de7d77ad8ef5cac16c61569c92

SHA256
e9729112633b5e23b2cb67e0050129cbcab51bfadb34646f033707ec75f7fd98

SHA512
a1143e50f1deea80db9b39b6fcd8e65b4a38ddc7e01af6fa6af313f24ddfc715e83f61eeae2e04f37c5ab4560f346f7d3c360b6646deb29ff6cce5e716a38104

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\meetrounov.exe

Filesize
366.1MB

MD5
0f1c71b32b79c69580a2047de48151d5

SHA1
21f5a5060f0681de7d77ad8ef5cac16c61569c92

SHA256
e9729112633b5e23b2cb67e0050129cbcab51bfadb34646f033707ec75f7fd98

SHA512
a1143e50f1deea80db9b39b6fcd8e65b4a38ddc7e01af6fa6af313f24ddfc715e83f61eeae2e04f37c5ab4560f346f7d3c360b6646deb29ff6cce5e716a38104

Download Submit
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL

Filesize
2KB

MD5
dce9b749d38fdc247ab517e8a76e6102

SHA1
d6c5b6548e1a3da3326bd097c50c49fc7906be3f

SHA256
5087b8c7f2cecceac61d7bd02b939888cf2cc5a452676f28fd5c076eb1ae7ea7

SHA512
56c276f0a070da656c98520aa720994d78f1bf0bbb085a5f6fb4fd18fed2bbba1eb8e97b54d58eaa9a978d21d64678170f49c020feb19d8545d158a2d8d58446

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1at13tha.tme.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

Filesize
71KB

MD5
92d24961d2ebaacf1ace5463dfc9930d

SHA1
99ffaf6904ab616c33a37ce01d383e4a493df335

SHA256
9013688dec264c615178e151c2eb5f0b2eb9fe8cfad867b311d8581d921c73f3

SHA512
77598c77f219ab5234b8b84bcfe873f40e7464b224fac3c8568b300d3f2563f7ef5ad9ec5cccc0d719e7d3e489a164b04b6b36316196afea0b8051de3c751cc7

Download Submit
memory/1160-138-0x0000000000540000-0x0000000000902000-memory.dmp

Filesize
3.8MB

Download
memory/1160-139-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/1160-140-0x0000000004D60000-0x0000000004D82000-memory.dmp

Filesize
136KB

Download
memory/1160-157-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/2448-231-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-176-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-177-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-178-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-175-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-174-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-173-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-172-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-171-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-166-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/2448-170-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/3176-144-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3176-163-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3176-161-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3176-160-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3176-159-0x0000000006010000-0x000000000602A000-memory.dmp

Filesize
104KB

Download
memory/3176-158-0x00000000071A0000-0x000000000781A000-memory.dmp

Filesize
6.5MB

Download
memory/3176-156-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Filesize
120KB

Download
memory/3176-146-0x0000000005520000-0x0000000005586000-memory.dmp

Filesize
408KB

Download
memory/3176-145-0x00000000054B0000-0x0000000005516000-memory.dmp

Filesize
408KB

Download
memory/3176-143-0x0000000004D10000-0x0000000005338000-memory.dmp

Filesize
6.2MB

Download
memory/3176-142-0x00000000046D0000-0x00000000046E0000-memory.dmp

Filesize
64KB

Download
memory/3176-141-0x0000000004580000-0x00000000045B6000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads