taurus | c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063

General

Target

c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe
Size

1.2MB
MD5

c350b786bfc1908e0a1941c17e00878c
SHA1

8771cdfac861bd7c32fad8dfe22d0ca712f8e77c
SHA256

c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063
SHA512

25188e552bbbdd3923cf2c1042be653f56306de60e9507f5e1f6f6664c876c54e050b4e31746a96dc1c6bb98379bd8aa4ff961e41d1b189bc6594e4218c29728

Score

10^/10

taurus discovery spyware stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-56-0x0000000000400000-0x000000000052C000-memory.dmp	family_taurus_stealer

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

948 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

772 timeout.exe

pid	process
948	cmd.exe

pid	process
772	timeout.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.execmd.exe

description	pid	process	target process
PID 2036 wrote to memory of 948	2036	c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe	cmd.exe
PID 2036 wrote to memory of 948	2036	c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe	cmd.exe
PID 2036 wrote to memory of 948	2036	c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe	cmd.exe
PID 2036 wrote to memory of 948	2036	c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe	cmd.exe
PID 948 wrote to memory of 772	948	cmd.exe	timeout.exe
PID 948 wrote to memory of 772	948	cmd.exe	timeout.exe
PID 948 wrote to memory of 772	948	cmd.exe	timeout.exe
PID 948 wrote to memory of 772	948	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe
"C:\Users\Admin\AppData\Local\Temp\c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

C:\Windows\SysWOW64\cmd.exe
/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\c82df54dab8f4924ce82ec0dc2f623ad303fbb0a56dcf81de13ce53c37998063.exe
2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\timeout.exe
timeout /t 3
3⤵
- Delays execution with timeout.exe
PID:772

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/772-58-0x0000000000000000-mapping.dmp

Download
memory/948-57-0x0000000000000000-mapping.dmp

Download
memory/2036-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/2036-55-0x0000000001F00000-0x000000000202C000-memory.dmp

Filesize
1.2MB

Download
memory/2036-56-0x0000000000400000-0x000000000052C000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing