Analysis

  • max time kernel
    4294181s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    09-03-2022 14:47

General

  • Target

    0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe

  • Size

    774KB

  • MD5

    1f9f7e9daf64b52198b59b432d3dd852

  • SHA1

    784b9bf1830d887ba6b0dccb0ace6058553f12c1

  • SHA256

    0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee

  • SHA512

    0fac9a19ac606813eb42203497b8b104b6b80e1b2b00e5a7a5302ba80e3634dc42b0ed1f3947d19e13f150448f9a518db96938d45959fdf51310b0f45445655c

Score
10/10

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe
    "C:\Users\Admin\AppData\Local\Temp\0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Users\Admin\AppData\Local\Temp\0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe
      "{path}"
      2⤵
        PID:1068
      • C:\Users\Admin\AppData\Local\Temp\0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe
        "{path}"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 36
          3⤵
          • Program crash
          PID:1888

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/964-54-0x0000000000020000-0x00000000000E8000-memory.dmp

      Filesize

      800KB

    • memory/964-55-0x0000000074E90000-0x000000007557E000-memory.dmp

      Filesize

      6.9MB

    • memory/964-56-0x00000000048A0000-0x00000000048A1000-memory.dmp

      Filesize

      4KB

    • memory/964-57-0x0000000000440000-0x0000000000454000-memory.dmp

      Filesize

      80KB

    • memory/964-58-0x00000000045C0000-0x0000000004630000-memory.dmp

      Filesize

      448KB

    • memory/1204-59-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/1204-61-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/1204-65-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/1204-67-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/1204-69-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/1204-63-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/1204-71-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB