taurus | 31c06e5e4c6e0d17ab4e8fd1023a0a090b7c87a54a3dbbe157305acb78150880

Analysis

max time kernel
140s
max time network
157s
platform
windows10_x64
resource
win10-en-20210920
submitted
18/10/2021, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d6d0e261df768c8db74c6103d86dd1a0.exe
Size 407KB
Sample211018-l1w3hsddc8
SHA256 31c06e5e4c6e0d17ab4e8fd1023a0a090b7c87a54a3dbbe157305acb78150880
MD5 d6d0e261df768c8db74c6103d86dd1a0
SHA1 04708bec85ce493bb248034d814e186ac559527f
SHA512 409b8163f3bedf4e84facf56e5104eeff45d80959429c87a251483b1ddedbc031e23fa00cbc00fda9ba84080055a589788ebc67274582ea205894caea4fad645
MD5 SHA1 SHA512

Score

10^/10

taurus discovery spyware stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1720-117-0x0000000000400000-0x000000000179F000-memory.dmp	family_taurus_stealer
behavioral2/memory/1720-116-0x0000000001BF0000-0x0000000001C28000-memory.dmp	family_taurus_stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4000	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 692	1720	d6d0e261df768c8db74c6103d86dd1a0.exe	70
PID 1720 wrote to memory of 692	1720	d6d0e261df768c8db74c6103d86dd1a0.exe	70
PID 1720 wrote to memory of 692	1720	d6d0e261df768c8db74c6103d86dd1a0.exe	70
PID 692 wrote to memory of 4000	692	cmd.exe	72
PID 692 wrote to memory of 4000	692	cmd.exe	72
PID 692 wrote to memory of 4000	692	cmd.exe	72

C:\Users\Admin\AppData\Local\Temp\d6d0e261df768c8db74c6103d86dd1a0.exe
"C:\Users\Admin\AppData\Local\Temp\d6d0e261df768c8db74c6103d86dd1a0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\SysWOW64\cmd.exe
  /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\d6d0e261df768c8db74c6103d86dd1a0.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:4000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-117-0x0000000000400000-0x000000000179F000-memory.dmp

Download

memory/1720-116-0x0000000001BF0000-0x0000000001C28000-memory.dmp