Analysis

  • max time kernel
    182s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    15-02-2022 20:38

General

  • Target

    0789d73d267431f0bf6ed2dea3885a4cc00e185b635b2378ece2f4c3ecaad254.exe

  • Size

    435KB

  • MD5

    e6ee67b002cb6faa103debeb3c903ba6

  • SHA1

    fd6a295b24dce06d59173e8e0dbe935c41988ffd

  • SHA256

    0789d73d267431f0bf6ed2dea3885a4cc00e185b635b2378ece2f4c3ecaad254

  • SHA512

    043b8f18eae512b0cc65fcca0ce3f447e459d7bcaccfd5846a481f6f5fac7d047294e10f5485a341ab929e34f1c9ad474d3ff468564e6308b5d7ea35d9698b03

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 52 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0789d73d267431f0bf6ed2dea3885a4cc00e185b635b2378ece2f4c3ecaad254.exe
    "C:\Users\Admin\AppData\Local\Temp\0789d73d267431f0bf6ed2dea3885a4cc00e185b635b2378ece2f4c3ecaad254.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Windows\SysWOW64\cmd.exe
      /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\0789d73d267431f0bf6ed2dea3885a4cc00e185b635b2378ece2f4c3ecaad254.exe
      2⤵
        PID:2884
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 3
          3⤵
          • Delays execution with timeout.exe
          PID:3960
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:3468
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:2636
    • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
      C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:3656

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1016-130-0x00000000021F0000-0x000000000225F000-memory.dmp

      Filesize

      444KB

    • memory/1016-131-0x0000000000400000-0x000000000046F000-memory.dmp

      Filesize

      444KB