Analysis
-
max time kernel
23s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-07-2021 02:26
Static task
static1
Behavioral task
behavioral1
Sample
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe
Resource
win7v20210408
0 signatures
0 seconds
General
-
Target
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe
-
Size
339KB
-
MD5
85d26f599f100e876542f3977e8539c5
-
SHA1
82289e92aa61b145b7c966293acfd0cb9ab9d5db
-
SHA256
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3
-
SHA512
322cd8ab595fa5b6dbfe5ce0b720f41d18d1a4917cd43e373b62669c51b41397d8aab811f577e325d0bf54474ca5db5cd1ea1979de9ddfabd0148ad081c32f4b
Malware Config
Signatures
-
Taurus Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1820-120-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/1820-121-0x000000000041CEDA-mapping.dmp family_taurus_stealer behavioral2/memory/1820-122-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exedescription pid process target process PID 4092 set thread context of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exedescription pid process Token: SeDebugPrivilege 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exedescription pid process target process PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 4092 wrote to memory of 1820 4092 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe"C:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exeC:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe2⤵PID:1820