Analysis

  • max time kernel
    125s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29-01-2023 19:28

General

  • Target

    5352f470b8e0b010ff9e91f24c0cc9dde3503d1ab8b4fcc2b465e8ac7ff00e3e.exe

  • Size

    2.8MB

  • MD5

    c87ffcc56d22fe7d726d5a80df3b465d

  • SHA1

    55d2d2d103d9182641bb4ab7a46bf742ecc5679e

  • SHA256

    5352f470b8e0b010ff9e91f24c0cc9dde3503d1ab8b4fcc2b465e8ac7ff00e3e

  • SHA512

    2e1ed39e24050f5162bd75dcd55069dd4a069da810f4a28ec94346dd7e224a3e880779e6cdf686e5f74bd91b1fc77a1e4f2ab98ab20c212e3204bfbd299f8dc1

  • SSDEEP

    24576:h+GoETAZV5BH7U2OLrGylE8WOndzAripxeAjGcE9+Pr7SyIfGqAZt+zQxBEm0Kn1:gGpeZ7UVuyrpeOzEWr7SrWZn

Malware Config

Signatures

  • Taurus Stealer

    Taurus is an infostealer first seen in June 2020.

  • Taurus Stealer payload 9 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5352f470b8e0b010ff9e91f24c0cc9dde3503d1ab8b4fcc2b465e8ac7ff00e3e.exe
    "C:\Users\Admin\AppData\Local\Temp\5352f470b8e0b010ff9e91f24c0cc9dde3503d1ab8b4fcc2b465e8ac7ff00e3e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1564
    • C:\Users\Admin\AppData\Local\Temp\5352f470b8e0b010ff9e91f24c0cc9dde3503d1ab8b4fcc2b465e8ac7ff00e3e.exe
      "C:\Users\Admin\AppData\Local\Temp\5352f470b8e0b010ff9e91f24c0cc9dde3503d1ab8b4fcc2b465e8ac7ff00e3e.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Windows\SysWOW64\cmd.exe
        /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\Temp\5352f470b8e0b010ff9e91f24c0cc9dde3503d1ab8b4fcc2b465e8ac7ff00e3e.exe
        3⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 3
          4⤵
          • Delays execution with timeout.exe
          PID:1700

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1564-54-0x0000000000070000-0x0000000000348000-memory.dmp
    Filesize

    2.8MB

  • memory/1564-55-0x0000000004C70000-0x0000000004D40000-memory.dmp
    Filesize

    832KB

  • memory/1564-56-0x0000000075611000-0x0000000075613000-memory.dmp
    Filesize

    8KB

  • memory/1564-57-0x00000000006D0000-0x00000000006DA000-memory.dmp
    Filesize

    40KB

  • memory/1564-58-0x0000000004D40000-0x0000000004DA8000-memory.dmp
    Filesize

    416KB

  • memory/1700-76-0x0000000000000000-mapping.dmp
  • memory/1720-74-0x0000000000000000-mapping.dmp
  • memory/1932-64-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-62-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-65-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-67-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-68-0x000000000041CE4D-mapping.dmp
  • memory/1932-70-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-71-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-73-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-60-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-75-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB

  • memory/1932-59-0x0000000000400000-0x0000000000437000-memory.dmp
    Filesize

    220KB