Analysis

  • max time kernel
    163s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    09-03-2022 14:47

General

  • Target

    0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe

  • Size

    774KB

  • MD5

    1f9f7e9daf64b52198b59b432d3dd852

  • SHA1

    784b9bf1830d887ba6b0dccb0ace6058553f12c1

  • SHA256

    0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee

  • SHA512

    0fac9a19ac606813eb42203497b8b104b6b80e1b2b00e5a7a5302ba80e3634dc42b0ed1f3947d19e13f150448f9a518db96938d45959fdf51310b0f45445655c

Score
10/10

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe
    "C:\Users\Admin\AppData\Local\Temp\0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Users\Admin\AppData\Local\Temp\0eabc0c432964bfd9ac2cc2015cff3c168fee3a0c3a7f6cd36deb7e1024617ee.exe
      "{path}"
      2⤵
        PID:3236

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1320-130-0x0000000075360000-0x0000000075B10000-memory.dmp

      Filesize

      7.7MB

    • memory/1320-131-0x0000000000A60000-0x0000000000B28000-memory.dmp

      Filesize

      800KB

    • memory/1320-132-0x00000000059D0000-0x0000000005F74000-memory.dmp

      Filesize

      5.6MB

    • memory/1320-133-0x0000000005500000-0x0000000005592000-memory.dmp

      Filesize

      584KB

    • memory/1320-134-0x0000000005420000-0x00000000059C4000-memory.dmp

      Filesize

      5.6MB

    • memory/1320-135-0x00000000054E0000-0x00000000054EA000-memory.dmp

      Filesize

      40KB

    • memory/1320-136-0x0000000008120000-0x000000000864C000-memory.dmp

      Filesize

      5.2MB

    • memory/1320-137-0x0000000001440000-0x00000000014DC000-memory.dmp

      Filesize

      624KB

    • memory/3236-138-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/3236-139-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

    • memory/3236-140-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB