Analysis

  • max time kernel
    124s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    18-10-2021 10:00

General

  • Target

    fc73a6d7ba29346cec2696e05861af8a.msi

  • Size

    1.3MB

  • MD5

    fc73a6d7ba29346cec2696e05861af8a

  • SHA1

    463d5f12fd5c940323439cb023e2f46ffb4cabac

  • SHA256

    1ffa9fbad9e31dbaa54e8f72abe42fdccb47333d1aa07bf0c541d0011f7ac9cc

  • SHA512

    a42ecbd88a646b3fa0820304397980429cbee95efe66a273ee68edd32b410cd5c108d6400ed999f0e4923f03ad708f539b5bb4147292434bef02dd1706e59611

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fc73a6d7ba29346cec2696e05861af8a.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2092
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 7640604A6204996A5454B4806B32D51C
      2⤵
      • Loads dropped DLL
      PID:780
    • C:\Windows\Installer\MSIDBD.tmp
      "C:\Windows\Installer\MSIDBD.tmp" -p89l3Ccf4 -s1
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1800
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\Windows\SysWOW64\cmd.exe
          /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2436
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 3
            5⤵
            • Delays execution with timeout.exe
            PID:424

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\updateKMS.exe

    MD5

    57fb19fcafe6bf4faab9a5c593249be4

    SHA1

    25e0e14735a0864694c3e6d96ae91d38b02dd1f5

    SHA256

    47335ce2ac06bab49c4295f4ed06ed68a1e20aafbf4a59d2c28daaacd32893b0

    SHA512

    c3620ea90f9d808069ca0afcbdf24356199977d79643a32ab14ed21fc6e19495db98f3562aa4337065b5e95c5f95da0740c17484d7724a812c1e0ece8d040168

  • C:\Windows\Installer\MSI77F.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • C:\Windows\Installer\MSI83B.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • C:\Windows\Installer\MSI8E8.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • C:\Windows\Installer\MSIDBD.tmp

    MD5

    45e48997516c0d93885c88f9d186361d

    SHA1

    9967123fd1b6a62f65d0d2270f6689666aab24df

    SHA256

    e0e2aa6d65cf83b262ef4b2da82277e0e307c73629d1f44ec316a02cd22a4ca9

    SHA512

    0fce2eacdb63507288f9dabfa995d79f9e0597009b0dfd318dcd6989dbb3cca749e9b7fbc419fd245ca361fac57bb205c707007a121a51748994c5649d5d0a9a

  • C:\Windows\Installer\MSIDBD.tmp

    MD5

    45e48997516c0d93885c88f9d186361d

    SHA1

    9967123fd1b6a62f65d0d2270f6689666aab24df

    SHA256

    e0e2aa6d65cf83b262ef4b2da82277e0e307c73629d1f44ec316a02cd22a4ca9

    SHA512

    0fce2eacdb63507288f9dabfa995d79f9e0597009b0dfd318dcd6989dbb3cca749e9b7fbc419fd245ca361fac57bb205c707007a121a51748994c5649d5d0a9a

  • C:\Windows\Installer\MSIFEF2.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • \Windows\Installer\MSI77F.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • \Windows\Installer\MSI83B.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • \Windows\Installer\MSI8E8.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • \Windows\Installer\MSIFEF2.tmp

    MD5

    72b1c6699ddc2baab105d32761285df2

    SHA1

    fc85e9fb190f205e6752624a5231515c4ee4e155

    SHA256

    bf7f6f7e527ab8617766bb7a21c21b2895b5275c0e808756c2aadcd66eff8a97

    SHA512

    cde1e754d8dfb2fa55db243517b5dd3d75b209ea6387ef2e4be6157875e536db2373f23434a9e66c119150301c7b7cdf97de5a5544d94c03247b4ae716cbc170

  • memory/424-142-0x0000000000000000-mapping.dmp

  • memory/780-120-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/780-121-0x00000000004B0000-0x00000000004B1000-memory.dmp

    Filesize

    4KB

  • memory/780-119-0x0000000000000000-mapping.dmp

  • memory/1236-117-0x0000025D098E0000-0x0000025D098E2000-memory.dmp

    Filesize

    8KB

  • memory/1236-118-0x0000025D098E0000-0x0000025D098E2000-memory.dmp

    Filesize

    8KB

  • memory/1504-138-0x00000000007B6000-0x00000000007D9000-memory.dmp

    Filesize

    140KB

  • memory/1504-135-0x0000000000000000-mapping.dmp

  • memory/1504-139-0x0000000000470000-0x00000000005BA000-memory.dmp

    Filesize

    1.3MB

  • memory/1504-140-0x0000000000400000-0x000000000046A000-memory.dmp

    Filesize

    424KB

  • memory/1800-133-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

    Filesize

    4KB

  • memory/1800-132-0x0000000002FD0000-0x0000000002FD1000-memory.dmp

    Filesize

    4KB

  • memory/1800-130-0x0000000000000000-mapping.dmp

  • memory/2092-116-0x0000020DE6EF0000-0x0000020DE6EF2000-memory.dmp

    Filesize

    8KB

  • memory/2092-115-0x0000020DE6EF0000-0x0000020DE6EF2000-memory.dmp

    Filesize

    8KB

  • memory/2436-141-0x0000000000000000-mapping.dmp