Analysis

  • max time kernel
    118s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    18-10-2021 10:00

General

  • Target

    fc73a6d7ba29346cec2696e05861af8a.msi

  • Size

    1.3MB

  • MD5

    fc73a6d7ba29346cec2696e05861af8a

  • SHA1

    463d5f12fd5c940323439cb023e2f46ffb4cabac

  • SHA256

    1ffa9fbad9e31dbaa54e8f72abe42fdccb47333d1aa07bf0c541d0011f7ac9cc

  • SHA512

    a42ecbd88a646b3fa0820304397980429cbee95efe66a273ee68edd32b410cd5c108d6400ed999f0e4923f03ad708f539b5bb4147292434bef02dd1706e59611

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fc73a6d7ba29346cec2696e05861af8a.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1516
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:584
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 159F17F82927F1D0291D5EA00E717433
      2⤵
      • Loads dropped DLL
      PID:1456
    • C:\Windows\Installer\MSI4242.tmp
      "C:\Windows\Installer\MSI4242.tmp" -p89l3Ccf4 -s1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1792
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Windows\SysWOW64\cmd.exe
          /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 3
            5⤵
            • Delays execution with timeout.exe
            PID:2036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • C:\Windows\Installer\MSI3A81.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • C:\Windows\Installer\MSI3C65.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • C:\Windows\Installer\MSI3CF3.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • C:\Windows\Installer\MSI4242.tmp

    MD5

    45e48997516c0d93885c88f9d186361d

    SHA1

    9967123fd1b6a62f65d0d2270f6689666aab24df

    SHA256

    e0e2aa6d65cf83b262ef4b2da82277e0e307c73629d1f44ec316a02cd22a4ca9

    SHA512

    0fce2eacdb63507288f9dabfa995d79f9e0597009b0dfd318dcd6989dbb3cca749e9b7fbc419fd245ca361fac57bb205c707007a121a51748994c5649d5d0a9a

  • C:\Windows\Installer\MSI4242.tmp

    MD5

    45e48997516c0d93885c88f9d186361d

    SHA1

    9967123fd1b6a62f65d0d2270f6689666aab24df

    SHA256

    e0e2aa6d65cf83b262ef4b2da82277e0e307c73629d1f44ec316a02cd22a4ca9

    SHA512

    0fce2eacdb63507288f9dabfa995d79f9e0597009b0dfd318dcd6989dbb3cca749e9b7fbc419fd245ca361fac57bb205c707007a121a51748994c5649d5d0a9a

  • \Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • \Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • \Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • \Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • \Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • \Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • \Windows\Installer\MSI3A81.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • \Windows\Installer\MSI3C65.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • \Windows\Installer\MSI3CF3.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • memory/1272-70-0x0000000000000000-mapping.dmp

  • memory/1272-77-0x0000000000540000-0x0000000000564000-memory.dmp

    Filesize

    144KB

  • memory/1272-79-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1272-78-0x00000000002D0000-0x000000000033A000-memory.dmp

    Filesize

    424KB

  • memory/1456-56-0x0000000076B61000-0x0000000076B63000-memory.dmp

    Filesize

    8KB

  • memory/1456-55-0x0000000000000000-mapping.dmp

  • memory/1516-53-0x000007FEFC4F1000-0x000007FEFC4F3000-memory.dmp

    Filesize

    8KB

  • memory/1780-80-0x0000000000000000-mapping.dmp

  • memory/1792-63-0x0000000000000000-mapping.dmp

  • memory/2036-82-0x0000000000000000-mapping.dmp