Analysis
- max time kernel
148s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
26/07/2023, 13:58
General
- Target install.exe
- Size 7.3MB
- Sample230726-rabxjscd63
- SHA256 21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab
Malware Config
Extracted
-
aurora
-
45.15.156.210:8081
Signatures
- Aurora
Aurora is a crypto wallet stealer written in Golang.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1972-133-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-138-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-143-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-144-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-145-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-146-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-147-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-148-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-149-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-150-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-151-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-152-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-153-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-154-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-155-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-156-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-157-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-158-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-159-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-160-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-161-0x0000000000460000-0x00000000007BC000-memory.dmp
memory/1972-162-0x0000000000460000-0x00000000007BC000-memory.dmp