Analysis

  • max time kernel
    30s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    19-03-2023 13:11

General

  • Target

    tmp.exe

  • Size

    7.5MB

  • MD5

    1431d295525534f244dd34a8a311b87f

  • SHA1

    2d0d2190ed780bf8dfed135bd1d12cae53860ebe

  • SHA256

    60f5cf24370600410d431405a2af891db1e19396a73d437b33f2e9c01e9fb27e

  • SHA512

    dd7085d43c12c1c7d59be73e66e5797966f7310fdd40ff2979fc770fa6fb5164484661fdfa7b73f8fc7a2dac32a452683f021e56fa4b1135bbbb9d140794ee02

  • SSDEEP

    24576:2H5qGTyaJEUcmADwRqPACrUJJiILBCR5LpWKMuy1rnwNnNQx/PEEDnpfuZWI9pIx:4qGTyMEQADwwACagk+lKo83Vz1

Score
10/10

Malware Config

Extracted

Family

aurora

C2

45.15.156.172:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1376
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1656
      • C:\Windows\System32\Wbem\wmic.exe
        wmic os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:856
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic path win32_VideoController get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1796
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1732
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic cpu get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic cpu get name
          4⤵
            PID:1684

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot

      Filesize

      71KB

      MD5

      e5e23f78017d1e6eddfc8480e1679ee4

      SHA1

      0667bd1b7129b105bd2c66ef6ad54c9648aec072

      SHA256

      4fed2f4c33a3876390d8520f184062927aca8e0ce3538127de3a2f66ea856d91

      SHA512

      b1260e7ba7ad6d5dd0daeabc5f7cc1fc7a2e9259092f8d70d3d9eed923ed8aa60adcce4c27e9cb20966d500ed59edaaba9570f01d6a84180f1fb83e7b5c20049

    • memory/1656-62-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-57-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-65-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-66-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-59-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-60-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-61-0x000007FFFFFDA000-0x000007FFFFFDB000-memory.dmp

      Filesize

      4KB

    • memory/1656-54-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-105-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-56-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-58-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-68-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-67-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-69-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-70-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-55-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-104-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB

    • memory/1656-64-0x0000000000400000-0x000000000075C000-memory.dmp

      Filesize

      3.4MB