Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    26-07-2023 13:58

General

  • Target

    install.exe

  • Size

    7.3MB

  • MD5

    7d26dce6ba89dedbd27455167f0a3044

  • SHA1

    19e3b77457a387ab5089b276056af074d0f8e77a

  • SHA256

    21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab

  • SHA512

    a474a6cd9a9195389a631f5f7637e212fe4f89f2d848a85acfa2778c5efc4c69047196ae6d7f78254fc600ebc00e2faf9d6bfeb2ac7c43f31062d7d827077f6d

  • SSDEEP

    24576:T0zKbWffNzzG+5DnKW4YRcTCDyO+QlehV7UC7vNbMWA9qIZ/QD83qZ/gbaq/EqJO:T0mbW3NzX5rtsTCAWtKCRGz1

Score
10/10

Malware Config

Extracted

Family

aurora

C2

45.15.156.210:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\install.exe
    "C:\Users\Admin\AppData\Local\Temp\install.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Users\Admin\AppData\Local\Temp\install.exe
      "C:\Users\Admin\AppData\Local\Temp\install.exe"
      2⤵
        PID:2516

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2516-54-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-56-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-58-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-60-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-62-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-64-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-66-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-68-0x000007FFFFFD8000-0x000007FFFFFD9000-memory.dmp
      Filesize

      4KB

    • memory/2516-70-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-72-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-73-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-74-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-75-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-76-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-77-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-78-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-79-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-80-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-81-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-82-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-83-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-84-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-85-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-86-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-87-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-88-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-89-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-90-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-91-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB

    • memory/2516-92-0x0000000000400000-0x000000000075C000-memory.dmp
      Filesize

      3.4MB