aurora | 87013c05921d9d97123f110c834aba2b81fae9f7866c0849396b82cc627a12be

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2023, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe
Size 3.8MB
Sample230308-bc7h8sdc25
SHA256 c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c
MD5 1c1ca2ed51b39a0eaf5a1f0938c27213
SHA1 f1398c6185a1e01cab88c9f3d022f6cd43785b8e
SHA512 d7b2b388e2948e2f3e0a2dcf1b098d1e6765ae4d9074eaa8de52da65fc046186087b6426e69a61a6e97aa07662b0918d2ff3bd59214f9d7ceb7d341d6cd4c49a
SSDEEP 49152:e4OuahtPKe0hSRjxv0H0W4Gih7Il3CCJCRhHHcaQlNwQNpJjVRdu:e2rhMj90H27IFCCMNQYQNpvO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

82.115.223.135:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0AF2EA14-11E7-412E-84CE-C2772690621E}.catalogItem	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5048 set thread context of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85
PID 5048 wrote to memory of 5036	5048	c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe	85

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe
"C:\Users\Admin\AppData\Local\Temp\c533034c68cf9b7b86b79950c132979106d33b05c2fb01f97b31c831c410f40c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:5036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
PID:3176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wsu81C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\wsu81C3.tmp
Size 36KB
SHA256 369a2323cb569b44970884d5af3d70e38c9cfb59a54d929fabb51ba46593aa06
MD5 761388ca8095173f6963b1d23ad8a68b
SHA1 41e2693d0efc36cb0b97ea215d554932c46464ab
SHA512 2db4576927b4325dc51ce1755d55b00f7153a10424ca79fb7f32f8c92a5dec899c3961b44a15a129f1e5234b53a89c8946192703b88b10e70e86670e5831ebdf
SSDEEP 768:2UGKIY3bL3ZALTL6ll91ce0oJsdfckb9N4uRFOWYi8Sh6zLMW5XOD/Z9:2reb+LTEl91ce0nb9N4uvOnznlODx9
MD5 SHA1 SHA512 SSDEEP

Submit Download

wsu862C.tmp

Path C:\Users\Admin\AppData\Local\Temp\wsu862C.tmp
Size 14KB
SHA256 32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40
MD5 c01eaa0bdcd7c30a42bbb35a9acbf574
SHA1 0aee3e1b873e41d040f1991819d0027b6cc68f54
SHA512 d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7
SSDEEP 192:cHmt+aD7DqyjNDWyBnEmL8bSzzoHKTw9rpKXji8xBk9ABhGVXSB1P1WWEN4+:cGgWjpDWyxEvcGrpKjBkyUC19u/
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 95f498bfc9f29d71149e564d1369e31e4d14238e899b6f9bb712efa5447a287e
MD5 84e86e27e9dfbe9495c0bdfd12961002
SHA1 6caecd8d737a7174d3a02a1ae8481d8099fa7145
SHA512 f6d92f14ae510d934cc2eb122a64ea6b70dacebd673f26227f3e0df993f48e2b1ff9316e0230254d6346c6c0d7c028103c15a4afc9c134c68ce9a5e2758cd3be
SSDEEP 768:hgM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:WM3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 9aaf19e75d56ad90b32b4004b2e4640cd7cf01bbbb636077f0e7c3825fce68e7
MD5 1658b9b1e5e9d157b1b900f1987f81f0
SHA1 c9ccd58d7d1e990b1228849bc223936992269a08
SHA512 35740c48c6b80549f075335aee02b8611a6802c677afb156942585572e37e10accc8f0e076e8670cc675b663c9d46b38f5ecfe0befba1b9bcebf81e02d933cbd
SSDEEP 768:vgM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:IM3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 8b1110cf12e71109e9af5eb86a9700cd4aae568b3058d094ac366782f143a087
MD5 d98c2ed2f3bcb21f5eda13a21038fd58
SHA1 77b7761d4ee5d4b793c5583462cac69b85e268c8
SHA512 7bc416a68518074f5a38dc5dbe5f0a5407949182ee374a63d18e5fd427aafa0646aa475f501e9b3d749caba67a879fa3df72e69a3800c08c30440f16d640766d
SSDEEP 768:fgM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:4M3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 4bb09313af6f73ff8f7844fd339158df5a89dd9eefa730900a923fd96b1085b9
MD5 5c1e2c94997a3ad8fef0d56371601547
SHA1 d6bdcbc2d8bfddcbe034603b90073427076e8bf6
SHA512 af4f35c078ebb331790b30a1bbd61738956d08050cfd41b088d37b87855bcb4888af496cdbc7db4da171094594adf6faa3198cd5da4aca912c8a83a168733415
SSDEEP 768:vgM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:IM3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 080093f03bb4e9777e6176a9b860c08712cbc31ae8ba9d245eefb300f3652ddd
MD5 20f9ce68c94ee6a06c525cf5c2bc3499
SHA1 d1e3965a19d06cc44d75be156749ec1de0117a79
SHA512 7e8496247fc4ce0213db3b4fe61e50c6ddbb6ae0abf59189d62d86f58292d07b2ca3b5e194f3c79c6a7f19157094a3a3033ae2527320fee0b6690312d78d2e04
SSDEEP 768:JgM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:eM3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 1c762a0799f075f0ed3c035418e1da1297589ec18fd4da65673eeb82e77922fd
MD5 73b29837ad88c81999d3714c7d4f7ce2
SHA1 48ca7c8876e03a1cdd045b503df5201eb267611a
SHA512 fa4e7648f4f426a7f0397aac4bcb9cdac4c41eaf5b3305558b4feee165830c41f8595791057a69f5f1580a258b73ec50dfbb78f01b91134f2e912e0c95b1b6b2
SSDEEP 768:PgM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:oM3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 2d71d265af52bc9ddd6cd0df0ba1d869422cfb6a6940de190d2fc6c69cd5ead6
MD5 99bb69a1d2827bde371fb2b28f750baa
SHA1 0cab4dd6445d1a2bc7107e672c5aad166d561051
SHA512 c1b2e77fb85e71b6f8bb5ded48152f5154eb8a7a13e000f879fe7a62c8cd12f39ba4cd5b126d2cb0a5ed050460f559984b3cda78bcfc343659418f7467e45887
SSDEEP 768:/gM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:YM3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 0b573448872c81c5f6d946722c9483cb282d5254c2c483d70b7aad342b38d2c4
MD5 3fee2dd09fdd64b20787cefccc71f31f
SHA1 02359968ac0abf46cfd4023559d25f9179d22514
SHA512 018998ec33c7a428128e01be714974fb159831ea1eca5de17a16dd0a1488a35c93a5600b6d58357eb5ebb91ca11901bac90b8bff8f55ceed907c8d025cadb19b
SSDEEP 768:fgM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:4M3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NCBCSZSJRSB.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Size 29KB
SHA256 e20d6aa6d1b4f6397c89115843dbadeaf554da0da19968b6920219d8e9371627
MD5 6a0d423c578a4d737d246938810aee4c
SHA1 2ab19cd01a8a7471543bb486016b41ae2eb8393b
SHA512 f4ffdfec2f16188e862f35af17d2266a24b513ff58783f3cdbe988a66d307b82600e7ba44bd4f57d24fade1df04f667385102b2621ed13b79a275665d421dcbb
SSDEEP 768:ogM3dI0Tum85g2ef/oK909s+TkUAR3/7v1ZjOdYMBmLmRnypw3wFPMDuS0Tum8Ow:pM3dI0Tum0g2K/rKRTkUo3/7v1JOdYwW
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NXQXXLFST89.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Size 66KB
SHA256 0ddf432bee9359c1dfdb027cc625d4d62ca6b53648066cabfaea8267d20aae3e
MD5 4a4111372a08d454cb6767dd813bd5a8
SHA1 0450422580eeb21f2e46b884fe93dfaf630b54b7
SHA512 ba617d1ba4ea12acac1ec8c1a0b34349eb724c06ce7a303b42641d10157140191a18194fef9e4955badc90781a4b37f40700b6068752c8452d4a782bf0637c73
SSDEEP 1536:kWuEjZnRxSYVe10d1eiGdp0WLwIUTZmZ92a/rC1jkUPrNHeE6YC51qhS0aY+LkTC:kj7+HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NXQXXLFST89.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Size 66KB
SHA256 c00de67a8187f9acd8ba4ac697a997e180c4ef8c231ad03feefbc2934186c8ec
MD5 d63e25eb8f0203c23fb74bf1f5264f39
SHA1 c6eb7d65375a7a9aecf9327faa6618981f6f4f62
SHA512 411517941b2659acce8687468118f50358eafe1e79de4fc6f65786f24d1f8b4d55024bf99f589b11da12cbb4e6396033c1f66c7c04a37b97fde5e9ff9e5b16eb
SSDEEP 1536:aWuEjZnRxSYVe10d1eiGdp0WLwIUTZmZ92a/rC1jkUPrNHeE6YC51qhS0aY+LkTC:aj7+HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NXQXXLFST89.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Size 66KB
SHA256 cffe312a914338f1b921f72e6b7e5805e2d8d8f8b49eada755d399b887974f70
MD5 3110cde456b8a6254b024dba97750e1d
SHA1 eb7a72912f7e63762eeb38ed8dae0ba767a69b5c
SHA512 96b44800ad2a505dbd3081b823b8f20abbf0ad1168a33f68f10be43a526a28d1cb15c3277638f781709660077be985a0eb2dd477e602fc7e52a956b284866e39
SSDEEP 1536:FWuEjZnRxSYVe10d1eiGdp0WLwIUTZmZ92a/rC1jkUPrNHeE6YC51qhS0aY+LkTC:Fj7+HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NXQXXLFST89.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Size 66KB
SHA256 98ca8eac57fe35a95747a9e040372b9575a94702e06e7914d505b57c7eb9638e
MD5 1aa188f51129f81ab1d6139ed87c66bb
SHA1 4b217713c6858ea0cc571fe79a64eb04721414d0
SHA512 eb8c58d52e08bb42ee7fea4a380d7e693b0fcc8e02acde6061ee2805453b0e1f069765f7a25a6dbfc94cc444527bf6c5269b05ed603559a4985605669d3c1df3
SSDEEP 1536:xWuEjZnRxSYVe10d1eiGdp0WLwIUTZmZ92a/rC1jkUPrNHeE6YC51qhS0aY+LkTC:xj7+HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NXQXXLFST89.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Size 66KB
SHA256 3f225770587dc820082d2285e730b12ad66e60d99159929db26b519367f2fb9e
MD5 31130e937e9d1f86ce865f7a43a96046
SHA1 b2fc2aff1aeec0e364ed8b4445567d16ab4f9f14
SHA512 5d4a302114119ddb915ac8647c128674046ad10e5a6b400e0d7e0ae08ea7c0d622920b5a09ec27b523a7d4cd1fa5055947f17ab440c9046fbb86ef19fdef54c2
SSDEEP 1536:TWuEjZnRxSYVe10d1eiGdp0WLwIUTZmZ92a/rC1jkUPrNHeE6YC51qhS0aY+LkTC:Tj7+HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NXQXXLFST89.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Size 66KB
SHA256 f51c955e38411945c181774945bba1598ab966af66099a5d1d51af3bcadc469e
MD5 66ac007cdd01f7c249e7bab593644209
SHA1 375d3c1b921c22f32622c567faf9da31198fd316
SHA512 8a92db3097344a41070dc6d4f45f4fd12ee5b590e2229bf75c719c1782429da7bc8f9b7b66958bb7db4ebbd5be4f6e7fa729b4b2653a56765cbed3ca4cbf1346
SSDEEP 1536:gWuEjZnRxSYVe10d1eiGdp0WLwIUTZmZ92a/rC1jkUPrNHeE6YC51qhS0aY+LkTC:gj7+HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

9NXQXXLFST89.dat

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NXQXXLFST89.dat
Size 66KB
SHA256 edfff413bb79b994abfbf26095f30db96909221756fd1ae63eaaf2627c00e119
MD5 5f230efea145170d5f9c55690c7db15d
SHA1 017b7fb792bf3d43f830802e5dc2d3c3090a58f9
SHA512 b02989b7ffd69e6b9fdf70bb1166e4dc78545def2c83977c9177db8eec2c21da0d9c46a721acd2044509ea213ec0b6ed9e9fd4768e23a854c35e0fcde0d9c99b
SSDEEP 1536:aWuEjZnRxSYVe10d1eiGdp0WLwIUTZmZ92a/rC1jkUPrNHeE6YC51qhS0aY+LkTC:aj7+HZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/5036-137-0x0000000000400000-0x0000000000731000-memory.dmp

Download

memory/5036-133-0x0000000000400000-0x0000000000731000-memory.dmp

Download

memory/5036-135-0x0000000000400000-0x0000000000731000-memory.dmp

Download

memory/5036-136-0x0000000000400000-0x0000000000731000-memory.dmp

Download

memory/5036-141-0x0000000000400000-0x0000000000731000-memory.dmp

Download

memory/5036-138-0x0000000000400000-0x0000000000731000-memory.dmp

Download

memory/5036-139-0x0000000000400000-0x0000000000731000-memory.dmp

Download

memory/5036-140-0x0000000000400000-0x0000000000731000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads