Analysis

  • max time kernel
    111s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    02-03-2022 06:03

General

  • Target

    83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe

  • Size

    505KB

  • MD5

    13b24673d1ed4ffce62b623c5842ab37

  • SHA1

    fdcd364e3148b2301d778ebe98a00741feca798c

  • SHA256

    83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b

  • SHA512

    476d3fcfca990c9828691e07a2a07ffe069d5a6f91d32292987df2994d112eedf11cc55526ff0fcc71bf9ea508a5453caf2520ec7e35f7f255032f87780f1d43

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe
    "C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe
      C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe
      2⤵
      • Executes dropped EXE
      PID:1344
    • C:\Windows\SysWOW64\cmd.exe
      /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0b.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1620
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 3
        3⤵
        • Delays execution with timeout.exe
        PID:4036
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 1336
      2⤵
      • Program crash
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1312
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3216 -ip 3216
    1⤵
    • Suspicious use of NtCreateProcessExOtherParentProcess
    • Suspicious use of WriteProcessMemory
    PID:3764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe

    MD5

    a767f197a9dab7a2caa273ffaeac4c3a

    SHA1

    2fa39063a7431d2bfd9e5ea65cf9ab6a3b4fdb23

    SHA256

    a5d19b118cf998fb745d2f1f3cbe1bdef208ddd15aee2342de2d18c9c903dded

    SHA512

    d5847f1202037bb98c983412117ae435ab1fdab0b96d4c1eb0be58e6e2c530a2b6d5f44736cd51a169486706d0bfe6ead0c1bcce7cec2ee8582436e70c367ced

  • C:\Users\Admin\AppData\Local\Temp\83d364c969b64ac72b8f8eb1e66d60c6915d10d385190d29ba6df82c67167f0bmgr.exe

    MD5

    a767f197a9dab7a2caa273ffaeac4c3a

    SHA1

    2fa39063a7431d2bfd9e5ea65cf9ab6a3b4fdb23

    SHA256

    a5d19b118cf998fb745d2f1f3cbe1bdef208ddd15aee2342de2d18c9c903dded

    SHA512

    d5847f1202037bb98c983412117ae435ab1fdab0b96d4c1eb0be58e6e2c530a2b6d5f44736cd51a169486706d0bfe6ead0c1bcce7cec2ee8582436e70c367ced

  • memory/3216-132-0x00000000033BC000-0x00000000033DD000-memory.dmp

    Filesize

    132KB

  • memory/3216-133-0x00000000033BC000-0x00000000033DD000-memory.dmp

    Filesize

    132KB

  • memory/3216-134-0x00000000032D0000-0x0000000003306000-memory.dmp

    Filesize

    216KB

  • memory/3216-135-0x0000000000400000-0x0000000000437000-memory.dmp

    Filesize

    220KB