taurus | acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73

General

Target

acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe
Size

571KB
MD5

3b162f81c028a43f6b00e69043fdb295
SHA1

9f057b9561b55d8b81db0b4de8239791ea043349
SHA256

acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73
SHA512

029430b4f59b4be230b91615b2439f4e51233d1d9ac3c3bcff61982cbd98ffead3d089d8c093427ee9b7b6a3442152611e335aa704b8f3caa54e995bb00cdea9

Score

10^/10

taurus spyware stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 7 IoCs

resource	yara_rule
behavioral1/memory/1396-63-0x0000000000080000-0x00000000000B7000-memory.dmp	family_taurus_stealer
behavioral1/memory/1396-65-0x0000000000080000-0x00000000000B7000-memory.dmp	family_taurus_stealer
behavioral1/memory/1396-66-0x0000000000080000-0x00000000000B7000-memory.dmp	family_taurus_stealer
behavioral1/memory/1396-69-0x000000000041CC9E-mapping.dmp	family_taurus_stealer
behavioral1/memory/1396-70-0x0000000000080000-0x00000000000B7000-memory.dmp	family_taurus_stealer
behavioral1/memory/1396-73-0x0000000000080000-0x00000000000B7000-memory.dmp	family_taurus_stealer
behavioral1/memory/1396-76-0x0000000000080000-0x00000000000B7000-memory.dmp	family_taurus_stealer

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
684	1972	WerFault.exe	19

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
364	timeout.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 1396	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	27
PID 1972 wrote to memory of 684	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	30
PID 1972 wrote to memory of 684	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	30
PID 1972 wrote to memory of 684	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	30
PID 1972 wrote to memory of 684	1972	acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe	30
PID 1396 wrote to memory of 1488	1396	mscorsvw.exe	31
PID 1396 wrote to memory of 1488	1396	mscorsvw.exe	31
PID 1396 wrote to memory of 1488	1396	mscorsvw.exe	31
PID 1396 wrote to memory of 1488	1396	mscorsvw.exe	31
PID 1488 wrote to memory of 364	1488	cmd.exe	33
PID 1488 wrote to memory of 364	1488	cmd.exe	33
PID 1488 wrote to memory of 364	1488	cmd.exe	33
PID 1488 wrote to memory of 364	1488	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe
"C:\Users\Admin\AppData\Local\Temp\acfb70e071355b050c3d3ad4e99c760b922d0ce85930b1d92403186c540d7d73.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\cmd.exe
    /c timeout /t 3 & del /f /q C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 3
      4⤵
      Delays execution with timeout.exe
      PID:364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 1768
  2⤵
  - Program crash
  PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1396-70-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1396-65-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1396-76-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1396-73-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1396-60-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1396-61-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1396-63-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1396-66-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1972-57-0x00000000006B0000-0x00000000006E0000-memory.dmp

Filesize
192KB

Download
memory/1972-54-0x0000000001220000-0x00000000012B6000-memory.dmp

Filesize
600KB

Download
memory/1972-59-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/1972-58-0x00000000005C0000-0x00000000005D8000-memory.dmp

Filesize
96KB

Download
memory/1972-56-0x0000000000390000-0x00000000003BE000-memory.dmp

Filesize
184KB

Download
memory/1972-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing