| File name: | Aura.exe |
| Full analysis: | https://app.any.run/tasks/2be3b92c-a233-481d-8606-474d948ef34e |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | January 05, 2025, 18:38:18 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 4 sections |
| MD5: | 320BF7FBC1C911B3359527BF0EA85FCA |
| SHA1: | CB1B1244C5E5F902E21252DEE0F017D3D4A03046 |
| SHA256: | 3B2C100E17A3A58006BFA5AB9FC0BD4A3951F6CA5449D0D8FF7F8F1B3A2C9884 |
| SSDEEP: | 12288:jtKoLPC8Y4W5Ndj0xkWZM6HvssjwoMW3l4/4SBcJTL7:jtK4PCxNh0CWZMwsuwoMWVrS2f |
| .exe | | | Win64 Executable (generic) (61.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.6) |
| .exe | | | Win32 Executable (generic) (10) |
| .exe | | | Win16/32 Executable Delphi generic (4.6) |
| .exe | | | Generic Win/DOS Executable (4.4) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2064:09:21 17:53:14+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 34304 |
| InitializedDataSize: | 1536 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa4be |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1448 | "C:\Users\admin\Desktop\Aura.exe" | C:\Users\admin\Desktop\Aura.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226505 Modules
| |||||||||||||||
| 2192 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3224 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Aura.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5340 | "C:\Users\admin\Desktop\Aura.exe" | C:\Users\admin\Desktop\Aura.exe | Aura.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 5872 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1448 -s 856 | C:\Windows\SysWOW64\WerFault.exe | Aura.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5872 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Aura.exe_4724175c1ff2da3c946950a8381a3cf04260dd3c_27bdd1c1_38bb54f7-3797-4a17-8ed7-b378bfa74111\Report.wer | — | |
MD5:— | SHA256:— | |||
| 5872 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\Aura.exe.1448.dmp | — | |
MD5:— | SHA256:— | |||
| 5872 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER7498.tmp.WERInternalMetadata.xml | xml | |
MD5:4DD2CA490D9C00437F99737CB927D4AE | SHA256:D7935161402DF61FDAE2E68BD979B8D2C4C601565EDD10FCCA84C5575788E3CB | |||
| 5872 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER74E7.tmp.xml | xml | |
MD5:540EF05B4B2F93E2CD832F0508D07243 | SHA256:814DF8EA7EE210FD874DE582124499C2D96C6E2D50A4315F81243BF0C8F5AB65 | |||
| 5872 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER734F.tmp.dmp | binary | |
MD5:E2AF3AA3D510020D32E0467398A0202C | SHA256:E625C82134F321E0F9A3F6A4C2056ADFB25E4B363D10742D5885B5EB5D84FCE6 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6072 | svchost.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6072 | svchost.exe | GET | 200 | 184.30.230.103:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5340 | Aura.exe | GET | — | 147.45.47.81:80 | http://147.45.47.81/conhost.exe | unknown | — | — | unknown |
— | — | POST | 200 | 104.21.16.1:443 | https://fancywaxxers.shop/api | unknown | text | 2 b | malicious |
— | — | POST | 200 | 104.21.32.1:443 | https://fancywaxxers.shop/api | unknown | text | 17 b | malicious |
— | — | POST | 200 | 104.21.96.1:443 | https://fancywaxxers.shop/api | unknown | text | 17 b | malicious |
— | — | POST | 200 | 104.21.112.1:443 | https://fancywaxxers.shop/api | unknown | text | 17 b | malicious |
— | — | POST | 200 | 104.21.16.1:443 | https://fancywaxxers.shop/api | unknown | text | 18.3 Kb | malicious |
— | — | POST | 200 | 104.21.80.1:443 | https://fancywaxxers.shop/api | unknown | text | 17 b | malicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6072 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.23.227.208:443 | www.bing.com | Ooredoo Q.S.C. | QA | whitelisted |
— | — | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5340 | Aura.exe | 104.21.96.1:443 | fancywaxxers.shop | CLOUDFLARENET | — | malicious |
6072 | svchost.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6072 | svchost.exe | 184.30.230.103:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| unknown |
google.com |
| whitelisted |
fancywaxxers.shop |
| malicious |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2192 | svchost.exe | Domain Observed Used for C2 Detected | ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fancywaxxers .shop) |
5340 | Aura.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) |
5340 | Aura.exe | A Network Trojan was detected | STEALER [ANY.RUN] Lumma Stealer TLS Connection |
5340 | Aura.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) |
5340 | Aura.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) |
5340 | Aura.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) |
5340 | Aura.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) |
5340 | Aura.exe | Domain Observed Used for C2 Detected | ET MALWARE Observed Win32/Lumma Stealer Related Domain (fancywaxxers .shop in TLS SNI) |
5340 | Aura.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 23 |
5340 | Aura.exe | Potentially Bad Traffic | ET INFO Executable Download from dotted-quad Host |