Analysis
-
max time kernel
118s -
max time network
128s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-02-2022 11:20
Static task
static1
Behavioral task
behavioral1
Sample
INVOICES_BL_AWB_2021.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
INVOICES_BL_AWB_2021.exe
-
Size
354KB
-
MD5
8ccf9291528b147f1ada20fe94dc822a
-
SHA1
3c379dfb7f6f26a067077cba102ee8d0ca992425
-
SHA256
4679648337426622a1f44b99207a036144b1e12391c36733eea10f63a02d0304
-
SHA512
549b7ea411857bea6e14a5d840ea030c5610d29306f675de16d6ae033116685f28271140485d0b2e06f7b08f8a5cd9caad2209691b64b26ab4313186bcb0b8b5
Malware Config
Signatures
-
Taurus Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/960-57-0x0000000000220000-0x0000000000259000-memory.dmp family_taurus_stealer behavioral1/memory/1612-55-0x0000000000400000-0x000000000043A000-memory.dmp family_taurus_stealer behavioral1/memory/1612-59-0x0000000000400000-0x000000000043A000-memory.dmp family_taurus_stealer -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1736 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
INVOICES_BL_AWB_2021.exedescription pid process target process PID 960 set thread context of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 988 timeout.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
INVOICES_BL_AWB_2021.exeINVOICES_BL_AWB_2021.execmd.exedescription pid process target process PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 960 wrote to memory of 1612 960 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 1612 wrote to memory of 1736 1612 INVOICES_BL_AWB_2021.exe cmd.exe PID 1612 wrote to memory of 1736 1612 INVOICES_BL_AWB_2021.exe cmd.exe PID 1612 wrote to memory of 1736 1612 INVOICES_BL_AWB_2021.exe cmd.exe PID 1612 wrote to memory of 1736 1612 INVOICES_BL_AWB_2021.exe cmd.exe PID 1736 wrote to memory of 988 1736 cmd.exe timeout.exe PID 1736 wrote to memory of 988 1736 cmd.exe timeout.exe PID 1736 wrote to memory of 988 1736 cmd.exe timeout.exe PID 1736 wrote to memory of 988 1736 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\timeout.exetimeout /t 34⤵
- Delays execution with timeout.exe
PID:988