Analysis
- max time kernel
208s - max time network
224s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
13/10/2023, 15:26
General
- Target NEAS.02d3b55e5624fdf9a70f619612e52e80_JC.exe
- Size 5.6MB
- Sample231013-sva2esda45
- SHA256 427e13816237fc35c72d6c25bb192c81d2dcb07ea7652260fbfec1e2738aea0a
Malware Config
Extracted
-
aurora
-
217.195.155.154:8081
Signatures
- Aurora
Aurora is a crypto wallet stealer written in Golang.
- Program crash 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.02d3b55e5624fdf9a70f619612e52e80_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.02d3b55e5624fdf9a70f619612e52e80_JC.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 5362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 5402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 5642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 5482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 680 -s 6322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 680 -ip 6801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 680 -ip 6801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 680 -ip 6801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 680 -ip 6801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 680 -ip 6801⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/680-0-0x0000000002850000-0x0000000002851000-memory.dmp
memory/680-1-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-2-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-3-0x0000000003200000-0x000000000371F000-memory.dmp
memory/680-4-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-5-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-6-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-7-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-9-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-12-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-14-0x0000000000400000-0x00000000009A0000-memory.dmp
memory/680-16-0x0000000000400000-0x00000000009A0000-memory.dmp