Analysis
-
max time kernel
42s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 15:53
Static task
static1
Behavioral task
behavioral1
Sample
a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe
Resource
win7-20220414-en
General
-
Target
a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe
-
Size
340KB
-
MD5
2698acb7cbe77cc6fe1c91b9ae6a094a
-
SHA1
1b248628cd297083f9ba7a74f03aa62ed43d4bd1
-
SHA256
a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a
-
SHA512
12ea18d4b8ad3853e5200c6bf552c5d45f2dc5678ed8fdf31ac99a56f9fd913068a0f5b9fd758a4452b2f11ba84283398f674028cb269e27536fef373c9b82d6
Malware Config
Signatures
-
Taurus Stealer payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1912-56-0x0000000000290000-0x00000000002C6000-memory.dmp family_taurus_stealer behavioral1/memory/1912-57-0x0000000000400000-0x00000000047D9000-memory.dmp family_taurus_stealer behavioral1/memory/1912-61-0x0000000000400000-0x00000000047D9000-memory.dmp family_taurus_stealer -
Processes:
resource yara_rule behavioral1/memory/1912-55-0x0000000000400000-0x00000000047D9000-memory.dmp upx -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 560 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1572 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.execmd.exedescription pid process target process PID 1912 wrote to memory of 560 1912 a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe cmd.exe PID 1912 wrote to memory of 560 1912 a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe cmd.exe PID 1912 wrote to memory of 560 1912 a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe cmd.exe PID 1912 wrote to memory of 560 1912 a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe cmd.exe PID 560 wrote to memory of 1572 560 cmd.exe timeout.exe PID 560 wrote to memory of 1572 560 cmd.exe timeout.exe PID 560 wrote to memory of 1572 560 cmd.exe timeout.exe PID 560 wrote to memory of 1572 560 cmd.exe timeout.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe"C:\Users\Admin\AppData\Local\Temp\a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\a47bd76b1a8fad38780fb7d983d6634d565c42c6da702eb630218fcab05a2e4a.exe2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 33⤵
- Delays execution with timeout.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/560-59-0x0000000000000000-mapping.dmp
-
memory/1572-60-0x0000000000000000-mapping.dmp
-
memory/1912-54-0x0000000075CF1000-0x0000000075CF3000-memory.dmpFilesize
8KB
-
memory/1912-55-0x0000000000400000-0x00000000047D9000-memory.dmpFilesize
67.8MB
-
memory/1912-56-0x0000000000290000-0x00000000002C6000-memory.dmpFilesize
216KB
-
memory/1912-57-0x0000000000400000-0x00000000047D9000-memory.dmpFilesize
67.8MB
-
memory/1912-58-0x0000000000220000-0x0000000000241000-memory.dmpFilesize
132KB
-
memory/1912-61-0x0000000000400000-0x00000000047D9000-memory.dmpFilesize
67.8MB