Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
21-02-2022 11:20
Static task
static1
Behavioral task
behavioral1
Sample
INVOICES_BL_AWB_2021.exe
Resource
win7-en-20211208
0 signatures
0 seconds
General
-
Target
INVOICES_BL_AWB_2021.exe
-
Size
354KB
-
MD5
8ccf9291528b147f1ada20fe94dc822a
-
SHA1
3c379dfb7f6f26a067077cba102ee8d0ca992425
-
SHA256
4679648337426622a1f44b99207a036144b1e12391c36733eea10f63a02d0304
-
SHA512
549b7ea411857bea6e14a5d840ea030c5610d29306f675de16d6ae033116685f28271140485d0b2e06f7b08f8a5cd9caad2209691b64b26ab4313186bcb0b8b5
Malware Config
Signatures
-
Taurus Stealer Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4888-132-0x00000000001C0000-0x00000000001F9000-memory.dmp family_taurus_stealer behavioral2/memory/1364-133-0x0000000000400000-0x000000000043A000-memory.dmp family_taurus_stealer behavioral2/memory/1364-134-0x0000000000400000-0x000000000043A000-memory.dmp family_taurus_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
INVOICES_BL_AWB_2021.exedescription pid process target process PID 4888 set thread context of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2720 timeout.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
svchost.exedescription pid process Token: SeShutdownPrivilege 4692 svchost.exe Token: SeCreatePagefilePrivilege 4692 svchost.exe Token: SeShutdownPrivilege 4692 svchost.exe Token: SeCreatePagefilePrivilege 4692 svchost.exe Token: SeShutdownPrivilege 4692 svchost.exe Token: SeCreatePagefilePrivilege 4692 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
INVOICES_BL_AWB_2021.exeINVOICES_BL_AWB_2021.execmd.exedescription pid process target process PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 4888 wrote to memory of 1364 4888 INVOICES_BL_AWB_2021.exe INVOICES_BL_AWB_2021.exe PID 1364 wrote to memory of 2240 1364 INVOICES_BL_AWB_2021.exe cmd.exe PID 1364 wrote to memory of 2240 1364 INVOICES_BL_AWB_2021.exe cmd.exe PID 1364 wrote to memory of 2240 1364 INVOICES_BL_AWB_2021.exe cmd.exe PID 2240 wrote to memory of 2720 2240 cmd.exe timeout.exe PID 2240 wrote to memory of 2720 2240 cmd.exe timeout.exe PID 2240 wrote to memory of 2720 2240 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\INVOICES_BL_AWB_2021.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\timeout.exetimeout /t 34⤵
- Delays execution with timeout.exe
PID:2720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4692