taurus | 10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f

General

Target
10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f.exe
Size 323KB
Sample220418-krp26scch8
SHA256 10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f
MD5 3bad4fd4fe862e9d1bd7555dd440bc89
SHA1 888d1eb473b1bebee0fd8f28d885121b6db8f5f4
SHA512 7a0146b13297fe358fb9b0f0d68293fb6e17cc5a810f63deddf34febe6bef5318af1a85bb2e9a5d9059b33452c5db810509bcfc15280444735d88debfdaa5c55
MD5 SHA1 SHA512

Score

10^/10

taurus discovery spyware stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/memory/3392-132-0x0000000002850000-0x0000000002886000-memory.dmp	family_taurus_stealer
behavioral2/memory/3392-133-0x0000000000400000-0x0000000000C2A000-memory.dmp	family_taurus_stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Program crash 10 IoCs

pid	pid_target	Process	procid_target
804	3392	WerFault.exe	78
4020	3392	WerFault.exe	78
2836	3392	WerFault.exe	78
4732	3392	WerFault.exe	78
2076	3392	WerFault.exe	78
2244	3392	WerFault.exe	78
4788	3392	WerFault.exe	78
400	3392	WerFault.exe	78
4344	3392	WerFault.exe	78
3732	3392	WerFault.exe	78

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2472	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 4264	3392	10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f.exe	97
PID 3392 wrote to memory of 4264	3392	10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f.exe	97
PID 3392 wrote to memory of 4264	3392	10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f.exe	97
PID 4264 wrote to memory of 2472	4264	cmd.exe	100
PID 4264 wrote to memory of 2472	4264	cmd.exe	100
PID 4264 wrote to memory of 2472	4264	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f.exe
"C:\Users\Admin\AppData\Local\Temp\10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 700
  2⤵
  - Program crash
  PID:804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 688
  2⤵
  - Program crash
  PID:4020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 688
  2⤵
  - Program crash
  PID:2836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 788
  2⤵
  - Program crash
  PID:4732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 864
  2⤵
  - Program crash
  PID:2076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 956
  2⤵
  - Program crash
  PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1212
  2⤵
  - Program crash
  PID:4788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1260
  2⤵
  - Program crash
  PID:400
- C:\Windows\SysWOW64\cmd.exe
  /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\10b6537f866b45a2b44f15abda7c1ec06e5e22b9a3959d1d860a06968718af4f.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1276
  2⤵
  - Program crash
  PID:4344
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3392 -s 1272
  2⤵
  - Program crash
  PID:3732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3392 -ip 3392
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3392 -ip 3392
1⤵
PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3392 -ip 3392
1⤵
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3392 -ip 3392
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3392 -ip 3392
1⤵
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3392 -ip 3392
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3392 -ip 3392
1⤵
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3392 -ip 3392
1⤵
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3392 -ip 3392
1⤵
PID:4976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3392 -ip 3392
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3392-130-0x0000000000C9A000-0x0000000000CBB000-memory.dmp

Download

memory/3392-131-0x0000000000C9A000-0x0000000000CBB000-memory.dmp

Download

memory/3392-132-0x0000000002850000-0x0000000002886000-memory.dmp

Download

memory/3392-133-0x0000000000400000-0x0000000000C2A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads