Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    02-03-2022 06:03

General

  • Target

    83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe

  • Size

    505KB

  • MD5

    13b24673d1ed4ffce62b623c5842ab37

  • SHA1

    fdcd364e3148b2301d778ebe98a00741feca798c

  • SHA256

    83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b

  • SHA512

    476d3fcfca990c9828691e07a2a07ffe069d5a6f91d32292987df2994d112eedf11cc55526ff0fcc71bf9ea508a5453caf2520ec7e35f7f255032f87780f1d43

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe
    "C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe
      C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe
      2⤵
      • Executes dropped EXE
      PID:1532
    • C:\Windows\SysWOW64\cmd.exe
      /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1280
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 3
        3⤵
        • Delays execution with timeout.exe
        PID:1736

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe

    MD5

    a767f197a9dab7a2caa273ffaeac4c3a

    SHA1

    2fa39063a7431d2bfd9e5ea65cf9ab6a3b4fdb23

    SHA256

    a5d19b118cf998fb745d2f1f3cbe1bdef208ddd15aee2342de2d18c9c903dded

    SHA512

    d5847f1202037bb98c983412117ae435ab1fdab0b96d4c1eb0be58e6e2c530a2b6d5f44736cd51a169486706d0bfe6ead0c1bcce7cec2ee8582436e70c367ced

  • \Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe

    MD5

    a767f197a9dab7a2caa273ffaeac4c3a

    SHA1

    2fa39063a7431d2bfd9e5ea65cf9ab6a3b4fdb23

    SHA256

    a5d19b118cf998fb745d2f1f3cbe1bdef208ddd15aee2342de2d18c9c903dded

    SHA512

    d5847f1202037bb98c983412117ae435ab1fdab0b96d4c1eb0be58e6e2c530a2b6d5f44736cd51a169486706d0bfe6ead0c1bcce7cec2ee8582436e70c367ced

  • \Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe

    MD5

    a767f197a9dab7a2caa273ffaeac4c3a

    SHA1

    2fa39063a7431d2bfd9e5ea65cf9ab6a3b4fdb23

    SHA256

    a5d19b118cf998fb745d2f1f3cbe1bdef208ddd15aee2342de2d18c9c903dded

    SHA512

    d5847f1202037bb98c983412117ae435ab1fdab0b96d4c1eb0be58e6e2c530a2b6d5f44736cd51a169486706d0bfe6ead0c1bcce7cec2ee8582436e70c367ced

  • memory/880-58-0x0000000003180000-0x00000000031A2000-memory.dmp

    Filesize

    136KB

  • memory/880-59-0x0000000003180000-0x00000000031A2000-memory.dmp

    Filesize

    136KB

  • memory/880-60-0x0000000000250000-0x0000000000286000-memory.dmp

    Filesize

    216KB

  • memory/880-61-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB

  • memory/880-62-0x0000000075B11000-0x0000000075B13000-memory.dmp

    Filesize

    8KB