aurora | cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707

Analysis

max time kernel
292s
max time network
277s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
24/05/2024, 06:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer.exe
Size 7.5MB
Sample240524-g9atesge2w
SHA256 cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707
MD5 b2c713fe8dbaea840c00afd0f67f1d9d
SHA1 036dab17619a4ca6e1036d99b68b10aea5872968
SHA512 03276046a65a6fda948f63d3e5bb7d4466ff2933677c0f847f927d50b04f3d1600d3c7e5fc905f6a54f2de9fdedc46326d39c160ff37d3a4cd874d20f01cef18
SSDEEP 24576:24wquL3a5sUcuADwRSP5C5AG1yO80IpNKF7r1IlP6jBktGr4ICqJIJFTWjiQWdtC:CquL38soADw45Ccgk+lKCtoPEz1b
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

94.142.138.29:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 4132	2456	Installer.exe	80

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80
PID 2456 wrote to memory of 4132	2456	Installer.exe	80

C:\Users\Admin\AppData\Local\Temp\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\Installer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\Installer.exe
  "C:\Users\Admin\AppData\Local\Temp\Installer.exe"
  2⤵
  PID:4132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4132-0-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-13-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-15-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-14-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-12-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-10-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-5-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-11-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-16-0x0000000000010000-0x000000000036C000-memory.dmp

Download

memory/4132-22-0x0000000000010000-0x000000000036C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads