Analysis

  • max time kernel
    52s
  • max time network
    81s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16-03-2023 16:21

General

  • Target

    9d46f656238d21c07a1d280b8a23171d05ae87dbb136d4c0efefa578132058cf.exe

  • Size

    5.0MB

  • MD5

    4f253477a36850490e31add375d9cdad

  • SHA1

    0bbd876a81e43746595da1b71285ef6978ceb162

  • SHA256

    9d46f656238d21c07a1d280b8a23171d05ae87dbb136d4c0efefa578132058cf

  • SHA512

    c3fd8354070103f423b937f0dbe8d4a1285494ea14e4a5748b4b9936d019a4b38dd65d447a3471a8ba41f21275c33800e756666c9ba450276c7cd0f7b420b8b8

  • SSDEEP

    98304:UJbMKqBTZlgY5FlcBfclcPi7LO049CDZe:MMKslMBfcc67LrHD8

Score
10/10

Malware Config

Extracted

Family

aurora

C2

138.201.198.8:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d46f656238d21c07a1d280b8a23171d05ae87dbb136d4c0efefa578132058cf.exe
    "C:\Users\Admin\AppData\Local\Temp\9d46f656238d21c07a1d280b8a23171d05ae87dbb136d4c0efefa578132058cf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Windows\System32\Wbem\wmic.exe
        wmic os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4920
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic path win32_VideoController get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1224
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic cpu get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4552
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic cpu get name
          4⤵
            PID:3788
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 2328
        2⤵
        • Program crash
        PID:2968

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj
      Filesize

      72KB

      MD5

      2b8e1b75b4d4fdf0c640838191ac3946

      SHA1

      dfac012ccaa015f6a9ec5bd1c55ffa7b8074fb7f

      SHA256

      17a69481ffd684f025b0fe6b0f22529bd8454c49915e580da43fcb08a0c56e4e

      SHA512

      3c4de03250813dc78b772cc7e3246ac2726c37fae00844bfceda683e05506b53ba7ea95a06e2929e8ec736ccd50a9138e9f6e3c80980ebde5ed7ac66f06cc038

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
      Filesize

      3.0MB

      MD5

      a22f4f4fd882dc77ae4adcf180d34f1a

      SHA1

      b630ffa68e2fe05f60dec473368354e8c07a53c5

      SHA256

      a7e18f8334187302d07b411518c03f7b472b7ba17751e6f5d239541105aedd36

      SHA512

      1f1e5cb83dc8b95630702faea3107ffd6929dcbad1b30b5b7d77d5b7284d883a60fac0d802e7b9b624b45ee0362af08d5d8426b5d010e0f71cc1bd01c46a329e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe
      Filesize

      3.0MB

      MD5

      a22f4f4fd882dc77ae4adcf180d34f1a

      SHA1

      b630ffa68e2fe05f60dec473368354e8c07a53c5

      SHA256

      a7e18f8334187302d07b411518c03f7b472b7ba17751e6f5d239541105aedd36

      SHA512

      1f1e5cb83dc8b95630702faea3107ffd6929dcbad1b30b5b7d77d5b7284d883a60fac0d802e7b9b624b45ee0362af08d5d8426b5d010e0f71cc1bd01c46a329e

    • memory/4540-120-0x0000000004E50000-0x0000000004EEC000-memory.dmp
      Filesize

      624KB

    • memory/4540-121-0x0000000004D60000-0x0000000004D6A000-memory.dmp
      Filesize

      40KB

    • memory/4540-122-0x00000000050B0000-0x00000000050C0000-memory.dmp
      Filesize

      64KB

    • memory/4540-123-0x0000000004FB0000-0x0000000004FE6000-memory.dmp
      Filesize

      216KB

    • memory/4540-124-0x00000000060D0000-0x00000000060D6000-memory.dmp
      Filesize

      24KB

    • memory/4540-117-0x0000000000A80000-0x0000000000F76000-memory.dmp
      Filesize

      5.0MB

    • memory/4540-119-0x0000000004DB0000-0x0000000004E42000-memory.dmp
      Filesize

      584KB

    • memory/4540-130-0x000000000A220000-0x000000000A23A000-memory.dmp
      Filesize

      104KB

    • memory/4540-131-0x00000000086A0000-0x00000000086A6000-memory.dmp
      Filesize

      24KB

    • memory/4540-118-0x0000000005210000-0x000000000570E000-memory.dmp
      Filesize

      5.0MB

    • memory/4540-163-0x00000000050B0000-0x00000000050C0000-memory.dmp
      Filesize

      64KB