Static

static

8

msoffice_i...27.doc

windows7_x64

10

msoffice_i...27.doc

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    msoffice_invoice1764727.doc

  • Size

    97KB

  • Sample

    200803-gexmw79xys

  • MD5

    5d38f68c18e3d9557523b25ad3fe4a86

  • SHA1

    a2c736b4bb06131dbb828c79711a1c7ec729d501

  • SHA256

    eef4b50a6a9a4371bc70b9b79d033053f0419c8c216118a6b5046117e4d6e272

  • SHA512

    4a6dcba8e2563f09dda60ac52dcda7f93e699f254a745d04ebbec57564e37371470e9d41473c2e33ad11256dea9f7a811810aeab1263a203048058c83a3f73f9

Score
10/10
taurus_stealermacromacro_on_actionstealertrojanxlm

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://185.189.12.182/RLCOrLHeK.com
exe.dropper

http://185.189.12.182/FfvEZtUVUkHjw.com
exe.dropper

http://185.189.12.182/GUavFcvTh.com

Targets

    • Target

      msoffice_invoice1764727.doc

    • Size

      97KB

    • MD5

      5d38f68c18e3d9557523b25ad3fe4a86

    • SHA1

      a2c736b4bb06131dbb828c79711a1c7ec729d501

    • SHA256

      eef4b50a6a9a4371bc70b9b79d033053f0419c8c216118a6b5046117e4d6e272

    • SHA512

      4a6dcba8e2563f09dda60ac52dcda7f93e699f254a745d04ebbec57564e37371470e9d41473c2e33ad11256dea9f7a811810aeab1263a203048058c83a3f73f9

    Score
    10/10
    taurus_stealerstealertrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Taurus Stealer

      Taurus is an infostealer first seen in June 2020.

      trojanstealertaurus_stealer

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks