Analysis
-
max time kernel
130s -
max time network
155s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-05-2021 06:02
Static task
static1
Behavioral task
behavioral1
Sample
24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe
Resource
win7v20210410
0 signatures
0 seconds
General
-
Target
24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe
-
Size
1.3MB
-
MD5
7a9c574a3ef86ab174cc3a48f6b000d1
-
SHA1
4d7ceacb8b4685dc6826ab01a05449340befced7
-
SHA256
24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60
-
SHA512
4df2deaa71064671c14f316e3a4afa4517ccacde62728628eed66691ff6e12c85aefd9257cce9bc35778371f93edec05e9d45ecdd4e5e8e1c4325f013d863f86
Malware Config
Signatures
-
Taurus Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/200-124-0x0000000000400000-0x000000000043A000-memory.dmp family_taurus_stealer behavioral2/memory/200-125-0x000000000041EC63-mapping.dmp family_taurus_stealer behavioral2/memory/200-126-0x0000000000400000-0x000000000043A000-memory.dmp family_taurus_stealer -
Suspicious use of SetThreadContext 1 IoCs
Processes:
24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exedescription pid process target process PID 796 set thread context of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exedescription pid process target process PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe PID 796 wrote to memory of 200 796 24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe"C:\Users\Admin\AppData\Local\Temp\24b335b5bb52f65a242f90c1f10fe171a1a4b38214a192c387529aa69280ab60.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵PID:200