Analysis
-
max time kernel
156s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-05-2022 14:48
Static task
static1
Behavioral task
behavioral1
Sample
965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe
Resource
win7-20220414-en
General
-
Target
965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe
-
Size
213KB
-
MD5
ba50bcb3ff570034685a22f38aef53e9
-
SHA1
154d81d1af66e57a0c37e19e1fedd7b39308114a
-
SHA256
965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf
-
SHA512
0e73f8921fc8547bffdbc7ded3e0650bea6d4e5d5fe46d12b3ca65fc35dc0414bd5dc110d98dacb129c429751ab259b99fd3a2850b2be18fea2660e5c02ac308
Malware Config
Signatures
-
Taurus Stealer Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/904-55-0x00000000002D0000-0x0000000000305000-memory.dmp family_taurus_stealer behavioral1/memory/904-57-0x0000000000400000-0x00000000004EF000-memory.dmp family_taurus_stealer -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1824 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1648 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.execmd.exedescription pid process target process PID 904 wrote to memory of 1824 904 965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe cmd.exe PID 904 wrote to memory of 1824 904 965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe cmd.exe PID 904 wrote to memory of 1824 904 965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe cmd.exe PID 904 wrote to memory of 1824 904 965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe cmd.exe PID 1824 wrote to memory of 1648 1824 cmd.exe timeout.exe PID 1824 wrote to memory of 1648 1824 cmd.exe timeout.exe PID 1824 wrote to memory of 1648 1824 cmd.exe timeout.exe PID 1824 wrote to memory of 1648 1824 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe"C:\Users\Admin\AppData\Local\Temp\965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\965eb46e9c9e675a56ebde5068c8f63c2e281ce68d9c15cb45f36f0b485150cf.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/904-54-0x00000000005AB000-0x00000000005CC000-memory.dmpFilesize
132KB
-
memory/904-55-0x00000000002D0000-0x0000000000305000-memory.dmpFilesize
212KB
-
memory/904-56-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/904-57-0x0000000000400000-0x00000000004EF000-memory.dmpFilesize
956KB
-
memory/1648-59-0x0000000000000000-mapping.dmp
-
memory/1824-58-0x0000000000000000-mapping.dmp