taurus | 6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f

General

Target
6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe
Size 8.8MB
Sample220327-d2ssgshbaj
SHA256 6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f
MD5 0d623a364e6faa4b72ab37838b0809c8
SHA1 77f9dcc43d750af004bf7b5175f79004539d8d28
SHA512 f34a79a3c456ea148904e1337cc96c472bdae0d08939d15ec5a0c711f9e2814545532495a68fc4ec3854324fc19a09bee5a63a8193757b40e4c4cec4d607d41c
MD5 SHA1 SHA512

Score

10^/10

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4752-125-0x0000000000410000-0x00000000017D8000-memory.dmp	family_taurus_stealer

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-157025953-3125636059-437143553-1000\Software\Wine	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4752	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
5020	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4752	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe
4752	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 3816	4752	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe	83
PID 4752 wrote to memory of 3816	4752	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe	83
PID 4752 wrote to memory of 3816	4752	6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe	83
PID 3816 wrote to memory of 5020	3816	cmd.exe	81
PID 3816 wrote to memory of 5020	3816	cmd.exe	81
PID 3816 wrote to memory of 5020	3816	cmd.exe	81

C:\Users\Admin\AppData\Local\Temp\6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe
"C:\Users\Admin\AppData\Local\Temp\6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\cmd.exe
  /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\6f62c179d75c3fd9488c343e5077e49855e5ca5972073012d0550e733c62456f.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3816