aurotun | 6a423191f13c7ad09144c734664290f31ab57a9edf19432a44016354be3d3128

General

Target
PuGe.exe
Size 12.9MB
Sample250417-y42tdstkt5
SHA256 6a423191f13c7ad09144c734664290f31ab57a9edf19432a44016354be3d3128
MD5 dff1704bb81529e0f7596c501d1282e6
SHA1 181f5aa07c2e670d7b99b2af6152d36a4369bc7a
SHA512 60291ff38625a025deb3bb2070be61f49a1abf55c8896d172dfb1b8b4f89f70f81fe5f936886bfb23c7749f131e8477013332a438fa7e3b9787b3547989ed024
SSDEEP 196608:PxQXU0q4k7le19Lj17zAZ6hVY/hiMQURPRnqqmLHo2cXG:Z0U0fk7le19Lj172PXQURPsZ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aurotun wmi persistence stealer

Malware Config

Extracted

Family

aurotun

Campaign

WMI

C2

45.227.252.199:7712

Attributes

anti_dbg
false
anti_sandbox
false
aurotun
false
disable_mutex
false
kx_pk
2yPDCOu1J4k7E7DKYs/u95NFrSxbNbqt1+peas9DGSc=
priviledge_escalation
false
seal_pk
eNKuEq5H3kyG+r9o2a0Yv0Stcr978SZIQa7iuYP1hSY=
sign_pk
DTt8g64I1pHERSQ15zgUKHpnT5q63I8LbAGGeVdBx7w=

Signatures

Aurotun
Aurotun is a stealer written in C++.
stealer aurotun
Aurotun family
aurotun

Detects Aurotun stealer 8 IoCs

resource	yara_rule
behavioral2/memory/2648-7-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun
behavioral2/memory/2648-6-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun
behavioral2/memory/2648-5-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun
behavioral2/memory/2648-4-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun
behavioral2/memory/2648-9-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun
behavioral2/memory/2648-8-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun
behavioral2/memory/2648-10-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun
behavioral2/memory/2648-12-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp	family_aurotun

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2316063146-1984817004-4437738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ginger.exe = "C:\\Users\\Public\\Music\\Ginger.exe"	reg.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
3	api.ipify.org
8	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4552 set thread context of 2648	4552	PuGe.exe	78

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2648	PuGe.exe
Token: SeImpersonatePrivilege	2648	PuGe.exe
Token: SeProfSingleProcessPrivilege	2648	PuGe.exe
Token: SeTakeOwnershipPrivilege	2648	PuGe.exe
Token: SeBackupPrivilege	2648	PuGe.exe
Token: SeRestorePrivilege	2648	PuGe.exe
Token: SeIncBasePriorityPrivilege	2648	PuGe.exe
Token: 33	2648	PuGe.exe
Token: SeSecurityPrivilege	2648	PuGe.exe
Token: SeIncreaseQuotaPrivilege	2648	PuGe.exe
Token: SeShutdownPrivilege	2648	PuGe.exe
Token: SeAssignPrimaryTokenPrivilege	2648	PuGe.exe
Token: SeIncBasePriorityPrivilege	2648	PuGe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2648	PuGe.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 2648	4552	PuGe.exe	78
PID 4552 wrote to memory of 2648	4552	PuGe.exe	78
PID 4552 wrote to memory of 2648	4552	PuGe.exe	78
PID 4552 wrote to memory of 2648	4552	PuGe.exe	78
PID 4552 wrote to memory of 5336	4552	PuGe.exe	79
PID 4552 wrote to memory of 5336	4552	PuGe.exe	79

C:\Users\Admin\AppData\Local\Temp\PuGe.exe
"C:\Users\Admin\AppData\Local\Temp\PuGe.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Users\Admin\AppData\Local\Temp\PuGe.exe
  C:\Users\Admin\AppData\Local\Temp\PuGe.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2648
- C:\Windows\system32\reg.exe
  reg.exe add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Ginger.exe /t REG_SZ /d C:\Users\Public\Music\Ginger.exe
  2⤵
  - Adds Run key to start application
  PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Public\Music\Ginger.exe
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2648-7-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

memory/2648-6-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

memory/2648-5-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

memory/2648-4-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

memory/2648-9-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

memory/2648-8-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

memory/2648-10-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

memory/2648-12-0x0000024DC03B0000-0x0000024DC0F4B000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads