Analysis

  • max time kernel
    100s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-03-2023 13:11

General

  • Target

    tmp.exe

  • Size

    7.5MB

  • MD5

    1431d295525534f244dd34a8a311b87f

  • SHA1

    2d0d2190ed780bf8dfed135bd1d12cae53860ebe

  • SHA256

    60f5cf24370600410d431405a2af891db1e19396a73d437b33f2e9c01e9fb27e

  • SHA512

    dd7085d43c12c1c7d59be73e66e5797966f7310fdd40ff2979fc770fa6fb5164484661fdfa7b73f8fc7a2dac32a452683f021e56fa4b1135bbbb9d140794ee02

  • SSDEEP

    24576:2H5qGTyaJEUcmADwRqPACrUJJiILBCR5LpWKMuy1rnwNnNQx/PEEDnpfuZWI9pIx:4qGTyMEQADwwACagk+lKo83Vz1

Score
10/10

Malware Config

Extracted

Family

aurora

C2

45.15.156.172:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:484
      • C:\Windows\System32\Wbem\wmic.exe
        wmic os get Caption
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4784
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic path win32_VideoController get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3972
      • C:\Windows\system32\cmd.exe
        cmd /C "wmic cpu get name"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1876
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic cpu get name
          4⤵
            PID:1212

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaL

      Filesize

      2KB

      MD5

      dce9b749d38fdc247ab517e8a76e6102

      SHA1

      d6c5b6548e1a3da3326bd097c50c49fc7906be3f

      SHA256

      5087b8c7f2cecceac61d7bd02b939888cf2cc5a452676f28fd5c076eb1ae7ea7

      SHA512

      56c276f0a070da656c98520aa720994d78f1bf0bbb085a5f6fb4fd18fed2bbba1eb8e97b54d58eaa9a978d21d64678170f49c020feb19d8545d158a2d8d58446

    • C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPj

      Filesize

      71KB

      MD5

      92d24961d2ebaacf1ace5463dfc9930d

      SHA1

      99ffaf6904ab616c33a37ce01d383e4a493df335

      SHA256

      9013688dec264c615178e151c2eb5f0b2eb9fe8cfad867b311d8581d921c73f3

      SHA512

      77598c77f219ab5234b8b84bcfe873f40e7464b224fac3c8568b300d3f2563f7ef5ad9ec5cccc0d719e7d3e489a164b04b6b36316196afea0b8051de3c751cc7

    • memory/484-144-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-133-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-145-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-146-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-147-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-148-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-149-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-143-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-138-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-204-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB

    • memory/484-205-0x0000000000A00000-0x0000000000D5C000-memory.dmp

      Filesize

      3.4MB