aurora | 9e32f9f73aff5225bfeb7f1403c168e189c38f53027175b3258fbad09d441c50

General

Target

459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe
Size

8.1MB
MD5

6a1d6f9f0d9f038b6bc64ee8d383143d
SHA1

5681bfc4587c40695e99daec0c75bef7946627c8
SHA256

459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c
SHA512

b640bbf2e72cacb73c97ed9ab3848d236e46909395f41b7ca77bfb796a12e3ba193d976aaf4f28cb373528297fbd8e30fa644e2377d7797e00cd1dce0a67b1c1
SSDEEP

98304:SdjxunlgScTvilUJQ38e8dR2SfX6IODGfL112bfaTl:SdjxClgSc7ilieK9X6I4GBAbfwl

Score

10^/10

aurora spyware stealer

Malware Config

Extracted

Family

aurora

C2

45.84.1.87:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

Processes:

459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe

description	pid	process	target process
PID 1584 set thread context of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exewmic.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe
Token: SeIncreaseQuotaPrivilege	340	wmic.exe
Token: SeSecurityPrivilege	340	wmic.exe
Token: SeTakeOwnershipPrivilege	340	wmic.exe
Token: SeLoadDriverPrivilege	340	wmic.exe
Token: SeSystemProfilePrivilege	340	wmic.exe
Token: SeSystemtimePrivilege	340	wmic.exe
Token: SeProfSingleProcessPrivilege	340	wmic.exe
Token: SeIncBasePriorityPrivilege	340	wmic.exe
Token: SeCreatePagefilePrivilege	340	wmic.exe
Token: SeBackupPrivilege	340	wmic.exe
Token: SeRestorePrivilege	340	wmic.exe
Token: SeShutdownPrivilege	340	wmic.exe
Token: SeDebugPrivilege	340	wmic.exe
Token: SeSystemEnvironmentPrivilege	340	wmic.exe
Token: SeRemoteShutdownPrivilege	340	wmic.exe
Token: SeUndockPrivilege	340	wmic.exe
Token: SeManageVolumePrivilege	340	wmic.exe
Token: 33	340	wmic.exe
Token: 34	340	wmic.exe
Token: 35	340	wmic.exe
Token: SeIncreaseQuotaPrivilege	340	wmic.exe
Token: SeSecurityPrivilege	340	wmic.exe
Token: SeTakeOwnershipPrivilege	340	wmic.exe
Token: SeLoadDriverPrivilege	340	wmic.exe
Token: SeSystemProfilePrivilege	340	wmic.exe
Token: SeSystemtimePrivilege	340	wmic.exe
Token: SeProfSingleProcessPrivilege	340	wmic.exe
Token: SeIncBasePriorityPrivilege	340	wmic.exe
Token: SeCreatePagefilePrivilege	340	wmic.exe
Token: SeBackupPrivilege	340	wmic.exe
Token: SeRestorePrivilege	340	wmic.exe
Token: SeShutdownPrivilege	340	wmic.exe
Token: SeDebugPrivilege	340	wmic.exe
Token: SeSystemEnvironmentPrivilege	340	wmic.exe
Token: SeRemoteShutdownPrivilege	340	wmic.exe
Token: SeUndockPrivilege	340	wmic.exe
Token: SeManageVolumePrivilege	340	wmic.exe
Token: 33	340	wmic.exe
Token: 34	340	wmic.exe
Token: 35	340	wmic.exe
Token: SeIncreaseQuotaPrivilege	760	WMIC.exe
Token: SeSecurityPrivilege	760	WMIC.exe
Token: SeTakeOwnershipPrivilege	760	WMIC.exe
Token: SeLoadDriverPrivilege	760	WMIC.exe
Token: SeSystemProfilePrivilege	760	WMIC.exe
Token: SeSystemtimePrivilege	760	WMIC.exe
Token: SeProfSingleProcessPrivilege	760	WMIC.exe
Token: SeIncBasePriorityPrivilege	760	WMIC.exe
Token: SeCreatePagefilePrivilege	760	WMIC.exe
Token: SeBackupPrivilege	760	WMIC.exe
Token: SeRestorePrivilege	760	WMIC.exe
Token: SeShutdownPrivilege	760	WMIC.exe
Token: SeDebugPrivilege	760	WMIC.exe
Token: SeSystemEnvironmentPrivilege	760	WMIC.exe
Token: SeRemoteShutdownPrivilege	760	WMIC.exe
Token: SeUndockPrivilege	760	WMIC.exe
Token: SeManageVolumePrivilege	760	WMIC.exe
Token: 33	760	WMIC.exe
Token: 34	760	WMIC.exe
Token: 35	760	WMIC.exe
Token: SeIncreaseQuotaPrivilege	760	WMIC.exe
Token: SeSecurityPrivilege	760	WMIC.exe
Token: SeTakeOwnershipPrivilege	760	WMIC.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exeInstallUtil.execmd.execmd.exe

description	pid	process	target process
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1584 wrote to memory of 1204	1584	459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe	InstallUtil.exe
PID 1204 wrote to memory of 340	1204	InstallUtil.exe	wmic.exe
PID 1204 wrote to memory of 340	1204	InstallUtil.exe	wmic.exe
PID 1204 wrote to memory of 340	1204	InstallUtil.exe	wmic.exe
PID 1204 wrote to memory of 340	1204	InstallUtil.exe	wmic.exe
PID 1204 wrote to memory of 964	1204	InstallUtil.exe	cmd.exe
PID 1204 wrote to memory of 964	1204	InstallUtil.exe	cmd.exe
PID 1204 wrote to memory of 964	1204	InstallUtil.exe	cmd.exe
PID 1204 wrote to memory of 964	1204	InstallUtil.exe	cmd.exe
PID 964 wrote to memory of 760	964	cmd.exe	WMIC.exe
PID 964 wrote to memory of 760	964	cmd.exe	WMIC.exe
PID 964 wrote to memory of 760	964	cmd.exe	WMIC.exe
PID 964 wrote to memory of 760	964	cmd.exe	WMIC.exe
PID 1204 wrote to memory of 616	1204	InstallUtil.exe	cmd.exe
PID 1204 wrote to memory of 616	1204	InstallUtil.exe	cmd.exe
PID 1204 wrote to memory of 616	1204	InstallUtil.exe	cmd.exe
PID 1204 wrote to memory of 616	1204	InstallUtil.exe	cmd.exe
PID 616 wrote to memory of 1872	616	cmd.exe	WMIC.exe
PID 616 wrote to memory of 1872	616	cmd.exe	WMIC.exe
PID 616 wrote to memory of 1872	616	cmd.exe	WMIC.exe
PID 616 wrote to memory of 1872	616	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe
"C:\Users\Admin\AppData\Local\Temp\459a3e9ef30e59ff28934170719d805ee5f05c44d8bd61f4fd8ed1e70047aa1c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic os get Caption
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic path win32_VideoController get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:964

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic path win32_VideoController get name
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\SysWOW64\cmd.exe
cmd /C "wmic cpu get name"
3⤵
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic cpu get name
4⤵
PID:1872

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TeMaPEZQleQYhYzRyWJjPjzpfRFEgmot
Filesize
71KB

MD5
2beb695add0546f6a18496aae58b2558

SHA1
1fd818202a94825c56ad7a7793bea87c6f02960e

SHA256
132cb7037ada7d8563c5b8cf64796ed22b0fbc1ccefbbbf5faa3c18545b289ed

SHA512
e80fa42ab27afa16e0f6f72639077be7da3e73f7c7b4cecbe0d24637ee76334de77a2b61e7c3afab4e3750e53a93baa68d3cdb9c1eb55fb9a5d580cff94f21f2

Download Submit
memory/1204-64-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-73-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-63-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-58-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-59-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-60-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-61-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-66-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-105-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-72-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-62-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1204-68-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-69-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-70-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1204-71-0x0000000000400000-0x0000000000731000-memory.dmp

Filesize
3.2MB

Download
memory/1584-56-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/1584-54-0x0000000000CF0000-0x000000000150A000-memory.dmp

Filesize
8.1MB

Download
memory/1584-55-0x000000001B500000-0x000000001B580000-memory.dmp

Filesize
512KB

Download
memory/1584-57-0x000000001BDA0000-0x000000001C06C000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads