aurora | cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707

Analysis

max time kernel
141s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
Size

7.5MB
MD5

b2c713fe8dbaea840c00afd0f67f1d9d
SHA1

036dab17619a4ca6e1036d99b68b10aea5872968
SHA256

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707
SHA512

03276046a65a6fda948f63d3e5bb7d4466ff2933677c0f847f927d50b04f3d1600d3c7e5fc905f6a54f2de9fdedc46326d39c160ff37d3a4cd874d20f01cef18
SSDEEP

24576:24wquL3a5sUcuADwRSP5C5AG1yO80IpNKF7r1IlP6jBktGr4ICqJIJFTWjiQWdtC:CquL38soADw45Ccgk+lKCtoPEz1b

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

94.142.138.29:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

description	pid	process	target process
PID 4084 set thread context of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

description	pid	process	target process
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 4084 wrote to memory of 3616	4084	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
"C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
  "C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe"
  2⤵
  PID:3616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3616-0-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-13-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-14-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-12-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-11-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-5-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-10-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-15-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download
memory/3616-20-0x0000000000380000-0x00000000006DC000-memory.dmp

Filesize
3.4MB

Download