aurora | 83d67c10baf6087354badb32305228e3addefca87641b2cf8fe7045daed43b10

Resubmissions

08/03/2024, 17:19

240308-vvs84sdd5110

15/02/2024, 05:23

240215-f3h1saad6310

Analysis

max time kernel
1793s
max time network
1816s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
runtime.exe
Size 1024.0MB
Sample240308-vvs84sdd51
SHA256 ff3977b7044b3739035cbd17b6d462886b7e228d666c780b8a70c887af797243
MD5 12e85f4fb4973d62ebfd30cf52412512
SHA1 097d71e82681fbaa290f8bf2f49929a2a1206e87
SHA512 bc44f93e99813b124307611b64af16d37d27dc637c50ea9a0852d3907850219ac08cd0316a944762434186ab3e3f5cce4d2c13efd7d4adab95680f3368976f22
SSDEEP 49152:pyWMOEmrU4VWLP6zev05oej0EL9gCegK/efy5d8A45EG273LCV0UOQJUh9q101GF:Eq6PQn4/9GEp32VLV+h9sF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora persistence stealer

Malware Config

Extracted

Family

aurora

167.235.58.189:456

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Executes dropped EXE 3 IoCs

pid	Process
2328	runtime.exe
4064	runtime.exe
4828	runtime.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_1 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\config\\runtime.exe"	runtime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_2 = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\config\\runtime.exe"	runtime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runtime_3 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\config\\runtime.exe"	runtime.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3508	schtasks.exe
3304	schtasks.exe
4468	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
828	powershell.exe
828	powershell.exe
828	powershell.exe
4064	powershell.exe
4064	powershell.exe
3372	powershell.exe
3372	powershell.exe
3372	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	powershell.exe
Token: SeDebugPrivilege	4064	powershell.exe
Token: SeDebugPrivilege	3372	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 828	1844	runtime.exe	94
PID 1844 wrote to memory of 828	1844	runtime.exe	94
PID 828 wrote to memory of 3508	828	powershell.exe	97
PID 828 wrote to memory of 3508	828	powershell.exe	97
PID 1844 wrote to memory of 4064	1844	runtime.exe	98
PID 1844 wrote to memory of 4064	1844	runtime.exe	98
PID 4064 wrote to memory of 3304	4064	powershell.exe	101
PID 4064 wrote to memory of 3304	4064	powershell.exe	101
PID 1844 wrote to memory of 3372	1844	runtime.exe	103
PID 1844 wrote to memory of 3372	1844	runtime.exe	103
PID 3372 wrote to memory of 4468	3372	powershell.exe	105
PID 3372 wrote to memory of 4468	3372	powershell.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\runtime.exe
"C:\Users\Admin\AppData\Local\Temp\runtime.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_1 /TR C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
    3⤵
    - Creates scheduled task(s)
    PID:3508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_2 /TR C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
    3⤵
    - Creates scheduled task(s)
    PID:3304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell "" "SCHTASKS.exe /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Create /SC MINUTE /ED 12/12/2030 /TN runtime_3 /TR C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
    3⤵
    - Creates scheduled task(s)
    PID:4468

C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
1⤵
- Executes dropped EXE
PID:2328

C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
1⤵
- Executes dropped EXE
PID:4828

C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
1⤵
- Executes dropped EXE
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe
MD5 440cb38dbee06645cc8b74d51f6e5f71
SHA1 d7e61da91dc4502e9ae83281b88c1e48584edb7c
SHA512 3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 1e16a7367fd045fdb2a5f6a3f80aeb2df7311370bf529b93fdef3cfa3d3a0f79
MD5 5cd36066b254e43e2b6f3e1b739c7158
SHA1 81463491c973e878cc4ef2ee1ae44ea7156cd7fb
SHA512 3cf7c5d29efb3b9482e011ec865796724feb748f7e4bb53af5226a921ca7cc97dbd4680d6a76be85f6f0a7ba68b48c63ac756193944caece0c83fc87bc9bd0a3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

runtime.exe

Path C:\Users\Admin\AppData\Local\Microsoft\config\runtime.exe
Size 832KB
SHA256 f09ba14bfd571da6d61b73e73a1ef32e402690b17eceada3b448e05e19c06aac
MD5 d90fa0993c13766003e5dbb781d6b0b7
SHA1 98a1c30f574be11cba7cbb58f6badc1e46831355
SHA512 0dd426aa87c6a33392cffec38d3d8ab327a90fd22cf673f9357d8cda68f0dd9aa5a631f437fafe5ad9f1ed12948124e2ed6ffbcc3ce4ecfb19dd3a00b2d24ca8
SSDEEP 6144:mE2kQVjnzTZfLWlDCy8J1nDtTbhBgxj1rnLaDOzAjyrVefuKwyuc0u9TrObV/XDd:piV7zNWcJ1RxOJ9fAmrU9YA0Vb7
MD5 SHA1 SHA512 SSDEEP

Submit Download

runtime.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
Size 11.5MB
SHA256 6bd2985040eec333f736941360d851a5c917f01a29bcd2dd1b1d0854bd63ec2c
MD5 065c03369d3ee8e0f62e8161aeded464
SHA1 cd15fd3895872d7427c84568f703bdd20a6116dd
SHA512 b4d586052e6fb9f7789ae806139b0f087c299bca5771fc4a74694c18327c4c3636fcdd77863878ab33a31224c4c7db36ed1819df66bf778b30ac6367e0af0cf6
SSDEEP 49152:pyWMOEmrU4VWLP6zev05oej0EL9gCegK/efy5d8A45EG273LCV0UOQJUh9q101GF:Eq6PQn4/9GEp32VLV+h9sF
MD5 SHA1 SHA512 SSDEEP

Submit Download

runtime.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
Size 1.6MB
SHA256 f5550b15ebd50bfa979b853c70e5abb3f42027fa7901ae8c714a6adc316514a6
MD5 ad23d36abbe4202957abf87195fa0a98
SHA1 3162fddec31f7182c8e0f764fa94d5214386b45a
SHA512 41d7086c32efb27ca57099c0914d974bd1ff042cddea8956d3cb254839400926bef236a8181249240c952f702ea187d30292c65ab9b5abfdf15e4ae529b01c0e
SSDEEP 12288:piV7zNWcJ1RxOJ9fAmrU9YA0VbWYzAxGxHMlYwtU3xvz7trUsELrzDziPA3OQMw:pyWMOJ9fAmrUKZFVWSMP6hl7wrzwA+dw
MD5 SHA1 SHA512 SSDEEP

Submit Download

runtime.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\config\runtime.exe
Size 896KB
SHA256 4d5d2e08ce9e176360b26404fb865e3211448d43517bcbf3554602301a3dfb50
MD5 3e17cf3ad2c02647b50b16f51939d186
SHA1 dc95e19da1746f8e35199e329f1dc3c31a9ced6c
SHA512 796e95eb8de432165afa8bbb0e6d496319da60a2c26a33398eff030948575452fad026825c4943d896d6a41502056012676d7143fcbac94146781d497cf728d3
SSDEEP 6144:mE2kQVjnzTZfLWlDCy8J1nDtTbhBgxj1rnLaDOzAjyrVefuKwyuc0u9TrObV/XDB:piV7zNWcJ1RxOJ9fAmrU9YA0VbWYzAxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_txlmkb1f.1vh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_txlmkb1f.1vh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

runtime.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\config\runtime.exe
Size 768KB
SHA256 46bcea81777ef12ac44bfedfac791b22d8d61b261bbb76a05f12f4c5eb07e7d4
MD5 b8e86914b03d9bbbfbb157fd0ec980a4
SHA1 e928a85cab48ca10e90f980fef024550d48944a4
SHA512 31ac5b7d4a45baf08b9143f4ab1f2a312a1d11a9e1fc7161149302cedf5dd2402e8e2765501ccf175eb6b25462d63684f253dcdc80e880af2db0b410c0a9967c
SSDEEP 6144:mE2kQVjnzTZfLWlDCy8J1nDtTbhBgxj1rnLaDOzAjyrVefuKwyuc0u9TrObV/XDb:piV7zNWcJ1RxOJ9fAmrU9YA0Vd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/828-17-0x000001F7080B0000-0x000001F7080C9000-memory.dmp

Download

memory/828-18-0x00007FF867C90000-0x00007FF868751000-memory.dmp

Download

memory/828-2-0x00007FF867C90000-0x00007FF868751000-memory.dmp

Download

memory/828-14-0x000001F707F50000-0x000001F707F60000-memory.dmp

Download

memory/828-4-0x000001F720DD0000-0x000001F720DF2000-memory.dmp

Download

memory/828-3-0x000001F707F50000-0x000001F707F60000-memory.dmp

Download

memory/3372-38-0x00007FF867BF0000-0x00007FF8686B1000-memory.dmp

Download

memory/3372-39-0x000001368CD30000-0x000001368CD40000-memory.dmp

Download

memory/3372-50-0x00007FF867BF0000-0x00007FF8686B1000-memory.dmp

Download

memory/3372-52-0x00007FF867BF0000-0x00007FF8686B1000-memory.dmp

Download

memory/4064-32-0x000001F027CB0000-0x000001F027CC0000-memory.dmp

Download

memory/4064-35-0x00007FF867C60000-0x00007FF868721000-memory.dmp

Download

memory/4064-31-0x00007FF867C60000-0x00007FF868721000-memory.dmp

Download