aurotun | 6a423191f13c7ad09144c734664290f31ab57a9edf19432a44016354be3d3128

General

Target
PuGe.exe
Size 12.9MB
Sample250417-y42tdstkt5
SHA256 6a423191f13c7ad09144c734664290f31ab57a9edf19432a44016354be3d3128
MD5 dff1704bb81529e0f7596c501d1282e6
SHA1 181f5aa07c2e670d7b99b2af6152d36a4369bc7a
SHA512 60291ff38625a025deb3bb2070be61f49a1abf55c8896d172dfb1b8b4f89f70f81fe5f936886bfb23c7749f131e8477013332a438fa7e3b9787b3547989ed024
SSDEEP 196608:PxQXU0q4k7le19Lj17zAZ6hVY/hiMQURPRnqqmLHo2cXG:Z0U0fk7le19Lj172PXQURPsZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Campaign

C2

Attributes

Detects Aurotun stealer 8 IoCs

resource	yara_rule
behavioral1/memory/3280-5-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun
behavioral1/memory/3280-6-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun
behavioral1/memory/3280-4-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun
behavioral1/memory/3280-7-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun
behavioral1/memory/3280-9-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun
behavioral1/memory/3280-8-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun
behavioral1/memory/3280-10-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun
behavioral1/memory/3280-12-0x000001914B360000-0x000001914BEFB000-memory.dmp	family_aurotun

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4097046113-3950943903-3587629992-1000\Control Panel\International\Geo\Nation	PuGe.exe

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4097046113-3950943903-3587629992-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ginger.exe = "C:\\Users\\Public\\Music\\Ginger.exe"	reg.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2904 set thread context of 3280	2904	PuGe.exe	82

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3280	PuGe.exe
Token: SeImpersonatePrivilege	3280	PuGe.exe
Token: SeProfSingleProcessPrivilege	3280	PuGe.exe
Token: SeTakeOwnershipPrivilege	3280	PuGe.exe
Token: SeBackupPrivilege	3280	PuGe.exe
Token: SeRestorePrivilege	3280	PuGe.exe
Token: SeIncBasePriorityPrivilege	3280	PuGe.exe
Token: 33	3280	PuGe.exe
Token: SeSecurityPrivilege	3280	PuGe.exe
Token: SeIncreaseQuotaPrivilege	3280	PuGe.exe
Token: SeShutdownPrivilege	3280	PuGe.exe
Token: SeAssignPrimaryTokenPrivilege	3280	PuGe.exe
Token: SeIncBasePriorityPrivilege	3280	PuGe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3280	PuGe.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 3280	2904	PuGe.exe	82
PID 2904 wrote to memory of 3280	2904	PuGe.exe	82
PID 2904 wrote to memory of 3280	2904	PuGe.exe	82
PID 2904 wrote to memory of 3280	2904	PuGe.exe	82
PID 2904 wrote to memory of 2416	2904	PuGe.exe	83
PID 2904 wrote to memory of 2416	2904	PuGe.exe	83

C:\Users\Admin\AppData\Local\Temp\PuGe.exe
"C:\Users\Admin\AppData\Local\Temp\PuGe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\PuGe.exe
  C:\Users\Admin\AppData\Local\Temp\PuGe.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3280
- C:\Windows\system32\reg.exe
  reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Ginger.exe /t REG_SZ /d C:\Users\Public\Music\Ginger.exe
  2⤵
  - Adds Run key to start application
  PID:2416