taurus | e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba

Analysis

max time kernel
4294183s
max time network
138s
platform
windows7_x64
resource
win7-20220311-en
submitted
19/03/2022, 22:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe
Size 351KB
Sample220319-18213aahak
SHA256 e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba
MD5 93d5c7c3bf0fb3ccebc6b1d8da41ebde
SHA1 24192981ee63e6b50da1739e75d3d1934e9e0356
SHA512 a7d84e32c8a131ddc667469fda27a1d681979995d9754dfe30e7c606da6cab68a665cf78fce6644326247102272ac176b25579aeaf0b597a01cf4d27fd9e7fc4
MD5 SHA1 SHA512

Score

10^/10

taurus discovery spyware stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 2 IoCs

resource	yara_rule
behavioral1/memory/1496-57-0x0000000000220000-0x0000000000255000-memory.dmp	family_taurus_stealer
behavioral1/memory/1496-58-0x0000000000400000-0x000000000517D000-memory.dmp	family_taurus_stealer

Deletes itself 1 IoCs

pid	Process
1560	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1508	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1560	1496	e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe	34
PID 1496 wrote to memory of 1560	1496	e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe	34
PID 1496 wrote to memory of 1560	1496	e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe	34
PID 1496 wrote to memory of 1560	1496	e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe	34
PID 1560 wrote to memory of 1508	1560	cmd.exe	37
PID 1560 wrote to memory of 1508	1560	cmd.exe	37
PID 1560 wrote to memory of 1508	1560	cmd.exe	37
PID 1560 wrote to memory of 1508	1560	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe
"C:\Users\Admin\AppData\Local\Temp\e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\SysWOW64\cmd.exe
  /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\e0ff40e2c34ebbe25f35b3cff069a1b8e739e79ffa3c43c224656b9937d0c5ba.exe
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:1508

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-54-0x00000000052F9000-0x0000000005319000-memory.dmp

Download

memory/1496-55-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Download

memory/1496-57-0x0000000000220000-0x0000000000255000-memory.dmp

Download

memory/1496-56-0x00000000052F9000-0x0000000005319000-memory.dmp

Download

memory/1496-58-0x0000000000400000-0x000000000517D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads