taurus | cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509

Analysis

max time kernel
80s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-05-2022 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509.exe
Size

427KB
MD5

8f21da8da7b08ae2e62ad9ec15e08d3a
SHA1

9130ca1e6f99434d6ffe784308fa2cd56f9a62b0
SHA256

cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509
SHA512

6cb98b982f8b3133db26a24718b395d3badbfa873504726c911c3a762404c7910edb4118df68da12bde095fbae45cea27bb82a1b566c6b0bd713c64e3bc88636

Score

10^/10

taurus discovery spyware stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4620-131-0x0000000000400000-0x00000000005B6000-memory.dmp	family_taurus_stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3388	timeout.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4632	4620	cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509.exe	85
PID 4620 wrote to memory of 4632	4620	cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509.exe	85
PID 4620 wrote to memory of 4632	4620	cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509.exe	85
PID 4632 wrote to memory of 3388	4632	cmd.exe	87
PID 4632 wrote to memory of 3388	4632	cmd.exe	87
PID 4632 wrote to memory of 3388	4632	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509.exe
"C:\Users\Admin\AppData\Local\Temp\cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Windows\SysWOW64\cmd.exe
  /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\cfd72dd72625e601864ea81340b5378ab283163cf1d8392d4534a9c77f53d509.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3
    3⤵
    - Delays execution with timeout.exe
    PID:3388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4620-130-0x00000000026C0000-0x000000000286E000-memory.dmp

Filesize
1.7MB

Download
memory/4620-131-0x0000000000400000-0x00000000005B6000-memory.dmp

Filesize
1.7MB

Download