Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
09/08/2023, 19:01
General
- Target vpn.exe
- Size 3.0MB
- Sample230809-xplceseh55
- SHA256 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d
Malware Config
Extracted
-
aurora
-
94.142.138.215:8081
Signatures
- Aurora
Aurora is a crypto wallet stealer written in Golang.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 14 IoCs
- Suspicious use of SendNotifyMessage 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\vpn.exe"C:\Users\Admin\AppData\Local\Temp\vpn.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1228-133-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-134-0x00000000772A4000-0x00000000772A6000-memory.dmp
memory/1228-135-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-136-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-137-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-138-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-139-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-140-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-141-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-142-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-143-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-144-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-145-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-146-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-147-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-149-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-150-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-152-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-154-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-156-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-157-0x0000000000610000-0x0000000000E32000-memory.dmp
memory/1228-159-0x0000000000610000-0x0000000000E32000-memory.dmp