Analysis
-
max time kernel
203s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 12:53
Static task
static1
Behavioral task
behavioral1
Sample
7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe
Resource
win7-20220414-en
General
-
Target
7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe
-
Size
927KB
-
MD5
c44e6d079cd330004ea0c04433cf40b5
-
SHA1
6fec949d132ed7dec67d62ec29914107411ecff8
-
SHA256
7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8
-
SHA512
ab1c26ac4040d6e60f889d92cd5996809d8061ed3b22dbe0724794f677d672f9896612b4c167a39bd20085e9e274b026f6cf7bbc2620ecb45170230ea97e2ac7
Malware Config
Signatures
-
Taurus Stealer Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2552-137-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/2552-138-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/2552-139-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral2/memory/2552-140-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exedescription pid process target process PID 4304 set thread context of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3684 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exedescription pid process Token: SeDebugPrivilege 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.execmd.exedescription pid process target process PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 4304 wrote to memory of 2552 4304 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe PID 2552 wrote to memory of 4456 2552 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe cmd.exe PID 2552 wrote to memory of 4456 2552 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe cmd.exe PID 2552 wrote to memory of 4456 2552 7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe cmd.exe PID 4456 wrote to memory of 3684 4456 cmd.exe timeout.exe PID 4456 wrote to memory of 3684 4456 cmd.exe timeout.exe PID 4456 wrote to memory of 3684 4456 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe"C:\Users\Admin\AppData\Local\Temp\7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe"C:\Users\Admin\AppData\Local\Temp\7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\7c776d7d4daa251c4a40fb3365645eefd53d4e35fcae7cff8f69b6b68910eae8.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 34⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2552-139-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2552-136-0x0000000000000000-mapping.dmp
-
memory/2552-137-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2552-138-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2552-140-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/3684-142-0x0000000000000000-mapping.dmp
-
memory/4304-131-0x0000000005A50000-0x0000000005FF4000-memory.dmpFilesize
5.6MB
-
memory/4304-132-0x0000000005380000-0x0000000005412000-memory.dmpFilesize
584KB
-
memory/4304-133-0x00000000054A0000-0x000000000553C000-memory.dmpFilesize
624KB
-
memory/4304-134-0x0000000005310000-0x000000000531A000-memory.dmpFilesize
40KB
-
memory/4304-135-0x0000000006530000-0x0000000006A5C000-memory.dmpFilesize
5.2MB
-
memory/4304-130-0x0000000000840000-0x000000000092C000-memory.dmpFilesize
944KB
-
memory/4456-141-0x0000000000000000-mapping.dmp