aurora | 15712faa167b2a875b7d28c8aa7e1d2c107877eb633c8de3f49b2e2faf9e7b94

Analysis

max time kernel
297s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2023 13:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Smart Game Booster 5_noOVL.exe
Size

3.1MB
MD5

2e3b1d6727fc76a1aa43636ff0704c3b
SHA1

ce5ad0ccb03acdd90ced16fedcf1a25fd081bc4b
SHA256

15712faa167b2a875b7d28c8aa7e1d2c107877eb633c8de3f49b2e2faf9e7b94
SHA512

6e9622818017eae868d6a8a28527bff470fa55292b7e3bf4ae3e08821cbb54136a5a5aae06ed6cca1704dbd220e55a5a869e2b4d28127d568b2b23aece0995a5
SSDEEP

98304:Mf8TSU/kWiZL5IH6R+N84p+AVHPSMhD0:y8PvPH6R+XJSMh4

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

77.91.124.12:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Smart Game Booster 5_noOVL.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Smart Game Booster 5_noOVL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Smart Game Booster 5_noOVL.exe

C:\Users\Admin\AppData\Local\Temp\Smart Game Booster 5_noOVL.exe
"C:\Users\Admin\AppData\Local\Temp\Smart Game Booster 5_noOVL.exe"
1⤵
- Checks BIOS information in registry
PID:2672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2672-133-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-134-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-135-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-136-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-137-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-138-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-139-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-140-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-141-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-142-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-143-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-144-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-145-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-146-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-147-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-148-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-149-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-150-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-151-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-152-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-153-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-154-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-155-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-156-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-157-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-158-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-159-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-160-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-161-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-162-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download
memory/2672-163-0x00000000001D0000-0x0000000000ACE000-memory.dmp

Filesize
9.0MB

Download