Analysis

  • max time kernel
    69s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    15-06-2021 14:49

General

  • Target

    79df2c0e7e331b3baa2dd5a241cbf05986f2482e8024e26a3362afdd790e94cf.exe

  • Size

    389KB

  • MD5

    484ad5a4fe183346cef417379bd0a714

  • SHA1

    a05dfb37a15f4275db2a49d6dcd2d37a85b57b46

  • SHA256

    79df2c0e7e331b3baa2dd5a241cbf05986f2482e8024e26a3362afdd790e94cf

  • SHA512

    1d7247c7db82f9c4c4a4a50176a0a1248e55a166deffe48e2263e08613f03e7fd266b4c5298eb6a8a0aa63567d0b1876d46650cf173fdeb1c1f73232b87cc12d

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79df2c0e7e331b3baa2dd5a241cbf05986f2482e8024e26a3362afdd790e94cf.exe
    "C:\Users\Admin\AppData\Local\Temp\79df2c0e7e331b3baa2dd5a241cbf05986f2482e8024e26a3362afdd790e94cf.exe"
    1⤵
      PID:3164
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 1672
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4032

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3164-114-0x0000000000DC0000-0x0000000000DF8000-memory.dmp

      Filesize

      224KB

    • memory/3164-115-0x0000000000400000-0x0000000000C2A000-memory.dmp

      Filesize

      8.2MB