Overview

overview

10

Static

static

1

C4Client.exe

windows7-x64

10

C4Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    C4Client.exe

  • Size

    1016KB

  • Sample

    230329-g1gwdafa48

  • MD5

    77081f23b31d05de271d128eebceb4bc

  • SHA1

    f06c4dd766c4784d6b513ca9bad819494e726c8b

  • SHA256

    10b527427042ca32d0683e016e2b5458799363d68bb4ee616b66ffdcd9377585

  • SHA512

    584db879c3360ec08d5f0e6bf08c87971b17ccf159674874fb5f54207087ef22ca953a9fe660d84c739e49621283ca3919b40735adad14e96eb4951c7dcd4c35

  • SSDEEP

    3072:0nTjRD5V730BSng7tJr8Khw6pItWgAEqjAxou3e7BNIdOAg0FujDvktlL0BjMwmk:G1V7h2r/hwNWgAEqjAKmkAOECjMwm

Score
10/10
auroraevasionspywarestealer

Malware Config

Extracted

Family

aurora

C2

107.182.129.73:8081

Targets

    • Target

      C4Client.exe

    • Size

      1016KB

    • MD5

      77081f23b31d05de271d128eebceb4bc

    • SHA1

      f06c4dd766c4784d6b513ca9bad819494e726c8b

    • SHA256

      10b527427042ca32d0683e016e2b5458799363d68bb4ee616b66ffdcd9377585

    • SHA512

      584db879c3360ec08d5f0e6bf08c87971b17ccf159674874fb5f54207087ef22ca953a9fe660d84c739e49621283ca3919b40735adad14e96eb4951c7dcd4c35

    • SSDEEP

      3072:0nTjRD5V730BSng7tJr8Khw6pItWgAEqjAxou3e7BNIdOAg0FujDvktlL0BjMwmk:G1V7h2r/hwNWgAEqjAKmkAOECjMwm

    Score
    10/10
    auroraevasionspywarestealer

    • Aurora

      Aurora is a crypto wallet stealer written in Golang.

      stealeraurora

    • Modifies security service

      evasion

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

2
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Impair Defenses

1
T1562

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks