aurora | cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707

Analysis

max time kernel
140s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
Size

7.5MB
MD5

b2c713fe8dbaea840c00afd0f67f1d9d
SHA1

036dab17619a4ca6e1036d99b68b10aea5872968
SHA256

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707
SHA512

03276046a65a6fda948f63d3e5bb7d4466ff2933677c0f847f927d50b04f3d1600d3c7e5fc905f6a54f2de9fdedc46326d39c160ff37d3a4cd874d20f01cef18
SSDEEP

24576:24wquL3a5sUcuADwRSP5C5AG1yO80IpNKF7r1IlP6jBktGr4ICqJIJFTWjiQWdtC:CquL38soADw45Ccgk+lKCtoPEz1b

Score

10^/10

aurora stealer

Malware Config

Extracted

Family

aurora

94.142.138.29:8081

Signatures

Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Suspicious use of SetThreadContext 1 IoCs

Processes:

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

description	pid	process	target process
PID 2528 set thread context of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

description	pid	process	target process
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
PID 2528 wrote to memory of 2744	2528	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe	cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe

C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
"C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2528

C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe
"C:\Users\Admin\AppData\Local\Temp\cd4b68e09b54472b54dba4f789f0d20ae4706fa9f6d4c90820db12fb956e1707.exe"
2⤵
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2744-0-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-12-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-18-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-21-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-23-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-20-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-19-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-16-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-14-0x000007FFFFFDA000-0x000007FFFFFDB000-memory.dmp

Filesize
4KB

Download
memory/2744-10-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-6-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-4-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-8-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-2-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-22-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-24-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download
memory/2744-30-0x0000000000400000-0x000000000075C000-memory.dmp

Filesize
3.4MB

Download