Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 16:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Aurora15Connector.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Aurora15Connector.exe
Resource
win11ltsc2024-20260710-en
3 signatures
150 seconds
General
- Target Aurora15Connector.exe
- Size 6.9MB
- Sample260910-tj2knsscjb
- SHA256 92f321cc119d685fd46a9b131d7acd6411cd9667b64e27f5a14ed7038730d56c
- MD5 c6b9505f3eefa2f9adf685e2d2af76ba
- SHA1 2dfaa6d4138882ef2c4bf281b1e2ec0ff1a3b2d3
- SHA512 c614e5e2930e9f696da11391b743422a71a973fd6b9201701130ad00d3a445561e2fab45231a0fbd241b3536cc49c16d82cf4690fcc37865d28527d5978c94a1
- SSDEEP 49152:EJMPZjnwbcjkDEg/Z1garVsSt5IxmDSIjo3sF8kFCHC/idUOaiDzVyDZE4pxSyG/:E9YayoMDdn6brVdk
- TLSH T108768D15A3E801A5E46BD734CA26D333CAB17C929634C14F0598F6462F73E929F6F326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5480 Aurora15Connector.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4820 Aurora15Connector.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4820 wrote to memory of 5480 4820 Aurora15Connector.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aurora15Connector.exe"C:\Users\Admin\AppData\Local\Temp\Aurora15Connector.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.exe"C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.exe" --launcher-update-probe --ready-file C:\Users\Admin\AppData\Local\Aurora15Connector\updates\update-b006041de9aa4cd99382c007b95fd165\launcher-5fd5d0cf00544a55ba0dd70a90cb0a12.ready --ready-token BFA486A6327BCE8289047734D61476CA925F190695A10B9A2F0BFDEE5FEAF6C2 --expected-sha256 63D0D7A9C054ACC66717A756EF82935B99453B3F9A5C96C52975A93AAD851B99 --expected-length 109527042⤵
- Executes dropped EXE
PID:5480
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.28118a76b00240698e6c6e07f3bda09a.new
- Size 10.4MB
- SHA256 63d0d7a9c054acc66717a756ef82935b99453b3f9a5c96c52975a93aad851b99
- MD5 fbabec311e67bbfbe4a523d114ee06dc
- SHA1 c80a6968536845d605dd6aa618ac463d9795faeb
- SHA512 bfd40c88caee28aabcca70d63722bfbea7a97a0fcf585a25bf7b98d228801da83204575f4e8070003bb903260673cc70c510762eb64dac3c20d338648176aa14
- SSDEEP 98304:JOwAg3AMp/UMAJQAv8D132jK6HbqlnN7G3yb1Si4Ju2SoCI+WaijK:JGg3AMZyCW8Dp2TH2lG+muRofK
- TLSH T1D0B69D14A3E501A5E57BDB34CA22C733CAB5BC925A34D10F0658F2C61F73A528B6F726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.ini
- Size 322B
- SHA256 3d49fe92bfb99eec8ab483963e33e61b5b4bb38f2359907e727420a8fdf5c25e
- MD5 884ecac13e273d37a4e6ad84a51a9923
- SHA1 612e787d51f6dfe6d49d92444f3a23a8bc9473c7
- SHA512 346081932168045ae93a1c760e1539e67741e451a53e178313444e77720c3580c96fcb6365ed374f3e8881b4f4cf6d5c8520a413b49fae5ad7ef94a4c97912e3
- TLSH T1ECE07D2333B651EF85F2A0AE901BEAB383B735290EC9E85310C41268315C410CB85091
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Aurora15Connector\logs\launcher.log
- Size 382B
- SHA256 2b805079d406babded84730f3b9f6fadc44021b69d7662129e4bf901482c240e
- MD5 86c5da4ae8aec1157b7dadab1620113b
- SHA1 7b1416c002e12523e025835dcb530de1eb94f612
- SHA512 2e25c35140daf8b5cac73ec0f820527596b8ae0416a3e2008ee39f1d7858cd5ad9abb4347a336b2ed0c58c6cec99dd921999403dd1486fbf45fa669e054b58ee
- TLSH T1AEE09B3565A744D7B29748CA804BEF975621A947B7014B7217D231E4283D70A5F37142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Aurora15Connector\logs\launcher.log
- Size 479B
- SHA256 4ec9ae193832d0465e90039d451e4a94d58354e13c82cc0941d9757a7c5c1902
- MD5 26281dfaa3d8f2346e7a4928e910350c
- SHA1 027a16d60a60a3b03c4547b650d675954161c882
- SHA512 60a1a8d4a3fa47d5cc81241149d5b03f9af4920dae93f3de167ae3b7757e5a4f50a99270dca83102aee6cca48b06e01e25295bbdf5a9ce6709bead1d18d164b3
- TLSH T138F02E3566B744D7B28748CEC04BEF975622A547F7014A7227D631F8283D7091F37142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Aurora15Connector\logs\launcher.log
- Size 1KB
- SHA256 16cb96a1d22736dddddc5610244fe686b2b9189b47e49204543affcd7c025e62
- MD5 06c3d67f2b389e2bd66871d5aeb4213e
- SHA1 6c09419903b4ea8ad12b70fca852a98d4006ef0a
- SHA512 e74dccd806cd3e438d5dc78d9d3cc7923cbe76b40880d7d62f9c6c65a643cc1ba740ad99dfb8dcdc0588aaf47cadff845e1f63ef78ceca7e3638cc56b8da1786
- TLSH T1D431C2286AAB05EB228344CA8457DFC65A62F74B63016F3137D93165957D70D0F3B393
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Aurora15Connector\updates\update-b006041de9aa4cd99382c007b95fd165\launcher-5fd5d0cf00544a55ba0dd70a90cb0a12.ready
- Size 64B
- SHA256 ce0543dd3bd585029c3f282f180d54ba070b3aaf477bb66d270d36dc2ec8ded5
- MD5 ad123c414b3be68a0229d278d28e08f9
- SHA1 78e01b0b091192961d58c530cb6d4c9d6c303828
- SHA512 311e4708f1f7ba8d804e0f41754f39041255ad157e67e353ee89651d14ee178a2ec6c2114426b1a2651e16a647703f0e4a2582960f3421368df26cc158216152
- TLSH T182A002E846C4D05D5C960AF0571D1A8F69766521164E1E3889DE087D05965C5462A1C8
- MD5 SHA1 SHA512 TLSH