taurus | dfa66d8411a9b5939db7b862f2a4f98a1bf7d393029a64c79468e3e9c8ad61b8

Analysis

max time kernel
164s
max time network
165s
platform
windows10_x64
resource
win10-en-20211014
submitted
18/10/2021, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
112e9be8f36d4a9365d5136b7ab79f7b.exe
Size 446KB
Sample211018-l1sebsecdj
SHA256 dfa66d8411a9b5939db7b862f2a4f98a1bf7d393029a64c79468e3e9c8ad61b8
MD5 112e9be8f36d4a9365d5136b7ab79f7b
SHA1 188b5b3dd2ac64c0d177f68b6dfec5e2d5b656b5
SHA512 0b39b41b5f173ed4b9e625f3569cdc9db7062a94e3860c0b379258f226eb7220b539539b884c8c887410aeeabb73658ecdefcdc2cc002dc1ae46045d56e363b3
MD5 SHA1 SHA512

Score

10^/10

taurus discovery spyware stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2308-116-0x00000000021E0000-0x0000000002218000-memory.dmp	family_taurus_stealer
behavioral2/memory/2308-117-0x0000000000400000-0x0000000000481000-memory.dmp	family_taurus_stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2948	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 3988	2308	112e9be8f36d4a9365d5136b7ab79f7b.exe	70
PID 2308 wrote to memory of 3988	2308	112e9be8f36d4a9365d5136b7ab79f7b.exe	70
PID 2308 wrote to memory of 3988	2308	112e9be8f36d4a9365d5136b7ab79f7b.exe	70
PID 3988 wrote to memory of 2948	3988	cmd.exe	72
PID 3988 wrote to memory of 2948	3988	cmd.exe	72
PID 3988 wrote to memory of 2948	3988	cmd.exe	72

C:\Users\Admin\AppData\Local\Temp\112e9be8f36d4a9365d5136b7ab79f7b.exe
"C:\Users\Admin\AppData\Local\Temp\112e9be8f36d4a9365d5136b7ab79f7b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\cmd.exe
  /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\112e9be8f36d4a9365d5136b7ab79f7b.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:2948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2308-116-0x00000000021E0000-0x0000000002218000-memory.dmp

Download

memory/2308-117-0x0000000000400000-0x0000000000481000-memory.dmp