aurora | e3dabeeca4921d902294c2d52711010848aa9a253f4c27b6c4ff986be6d5d9fe

General

Target

9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe
Size

9.6MB
MD5

e38edcf41b7b13dc8837e030774cf083
SHA1

1ed5f18fbc105fd177129f594d63e3297654acff
SHA256

9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc
SHA512

17021db0c40c5068c1df61e3682cd967fec74a76e661d5967b3950d2a0f2a3a64ea15abcfd21b89223fb541d3561172a0dbdcc2a63694996518e0fde8ced1080
SSDEEP

196608:JGujuxvOMsHXVCFzaixl/CcHsjGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG:JXdP3VC9CcMjGGGGGGGGGGGGGGGGGGGi

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

C2

94.142.138.215:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Suspicious use of SetThreadContext 1 IoCs

Processes:

9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe

description	pid	process	target process
PID 1212 set thread context of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe

description pid process

Token: SeDebugPrivilege 1212 9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe

description	pid	process
Token: SeDebugPrivilege	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe

description	pid	process	target process
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe
PID 1212 wrote to memory of 1500	1212	9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe
"C:\Users\Admin\AppData\Local\Temp\9e83c3a822bc5253e9b5047fd2ee19abce885852db7afcb70d9b76fc470f69bc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe"
2⤵
PID:1500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-54-0x0000000000860000-0x000000000120A000-memory.dmp

Filesize
9.7MB

Download
memory/1212-55-0x000000001BB90000-0x000000001BC10000-memory.dmp

Filesize
512KB

Download
memory/1212-56-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1212-57-0x000000001C080000-0x000000001C300000-memory.dmp

Filesize
2.5MB

Download
memory/1500-58-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-59-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-60-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-61-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-62-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-63-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-64-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-66-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-65-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1500-68-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-69-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-70-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-71-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-72-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-73-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download
memory/1500-74-0x0000000000400000-0x0000000000747000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing