Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:file.exe
Analysis ID:828932
MD5:d442830fc92de9465d9bf425922173a5
SHA1:27eaed777470e6a9f855894b2af3c7baa1c812eb
SHA256:5892a93d287a1e4bd97fb09b79b6e2af5643103511f3678c8212ec803ff3b449
Tags:exe
Infos:

Detection

Aurora
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara Aurora Stealer
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Snort IDS alert for network traffic
Machine Learning detection for sample
Injects a PE file into a foreign processes
C2 URLs / IPs found in malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Detected TCP or UDP traffic on non-standard ports
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 2284 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)
    • file.exe (PID: 4980 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)
    • file.exe (PID: 1092 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)
    • file.exe (PID: 1380 cmdline: C:\Users\user\Desktop\file.exe MD5: D442830FC92DE9465D9BF425922173A5)
      • WMIC.exe (PID: 5476 cmdline: wmic os get Caption MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)
        • conhost.exe (PID: 1280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • cmd.exe (PID: 3308 cmdline: cmd /C "wmic path win32_VideoController get name" MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 5880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • WMIC.exe (PID: 4072 cmdline: wmic path win32_VideoController get name MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)
      • cmd.exe (PID: 4140 cmdline: cmd /C "wmic cpu get name" MD5: F3BDBE3BB6F734E357235F4D5898582D)
        • conhost.exe (PID: 1420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • WMIC.exe (PID: 2324 cmdline: wmic cpu get name MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
AuroraRansomware
  • Oktropys
https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora

Malware Configuration

Threatname: Aurora

{"C2 url": "138.201.198.8:8081"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000003.00000002.483930551.0000000000400000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_AuroraYara Aurora StealerJoe Security
    00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_AuroraYara Aurora StealerJoe Security
      Process Memory Space: file.exe PID: 2284JoeSecurity_AuroraYara Aurora StealerJoe Security
        Process Memory Space: file.exe PID: 1380JoeSecurity_AuroraYara Aurora StealerJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          3.2.file.exe.400000.0.unpackJoeSecurity_AuroraYara Aurora StealerJoe Security
            3.2.file.exe.400000.0.raw.unpackJoeSecurity_AuroraYara Aurora StealerJoe Security
              0.2.file.exe.3f29930.1.unpackJoeSecurity_AuroraYara Aurora StealerJoe Security
                0.2.file.exe.3f29930.1.raw.unpackJoeSecurity_AuroraYara Aurora StealerJoe Security

                  Sigma Signatures

                  ⊘No Sigma rule has matched

                  Snort Signatures

                  Timestamp:138.201.198.8192.168.2.58081496952043200 03/17/23-17:30:41.217735
                  SID:2043200
                  Source Port:8081
                  Destination Port:49695
                  Protocol:TCP
                  Classtype:A Network Trojan was detected
                  Timestamp:138.201.198.8192.168.2.58081496952043199 03/17/23-17:30:40.120429
                  SID:2043199
                  Source Port:8081
                  Destination Port:49695
                  Protocol:TCP
                  Classtype:A Network Trojan was detected
                  Timestamp:138.201.198.8192.168.2.58081496952043198 03/17/23-17:30:09.566708
                  SID:2043198
                  Source Port:8081
                  Destination Port:49695
                  Protocol:TCP
                  Classtype:A Network Trojan was detected

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Multi AV Scanner detection for submitted file
                  Source: file.exeReversingLabs: Detection: 30%
                  Source: file.exeVirustotal: Detection: 26%Perma Link
                  Antivirus / Scanner detection for submitted sample
                  Source: file.exeAvira: detected
                  Antivirus detection for URL or domain
                  Source: 138.201.198.8:8081Avira URL Cloud: Label: malware
                  Machine Learning detection for sample
                  Source: file.exeJoe Sandbox ML: detected
                  Source: 0.0.file.exe.760000.0.unpackAvira: Label: TR/Dropper.Gen
                  Source: 0.2.file.exe.3f29930.1.unpackAvira: Label: TR/Patched.Ren.Gen
                  Source: 00000000.00000002.423994367.0000000003F21000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: Aurora {"C2 url": "138.201.198.8:8081"}
                  Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                  Source: file.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                  Source: Binary string: ClassLibrary2.pdb source: file.exe, 00000000.00000002.420469142.0000000002F21000.00000004.00000800.00020000.00000000.sdmp