taurus | b797a47861749b5269ac8853742b0ef7ee5739cc450480c82bafaaa270ed87b7

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 19:52

Target

b797a47861749b5269ac8853742b0ef7ee5739cc450480c82bafaaa270ed87b7.exe
Size

351KB
MD5

08566cf6af0080cc7d2fab254ccb7d8e
SHA1

3d094a64d250c1c67caadc1930d800973ddd8237
SHA256

b797a47861749b5269ac8853742b0ef7ee5739cc450480c82bafaaa270ed87b7
SHA512

e2791a497603738e0180a0be593ab28b3a89e340fe16baf71077184999b5eef2b6b5b7155072e82ae5035f7c2e668f881133d26a91a287129f05cc9373050244
SSDEEP

6144:gCDHU44quM5Vqrq1MtCZx1YfV+n0J0q5q+m2tEaELUTBk8IxWBvO4IwymeAl/:g344jgUrOMtyzSVHfI+vybHBxWlOTwsI

Score

10^/10

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4724-133-0x00000000001C0000-0x00000000001F8000-memory.dmp	family_taurus_stealer
behavioral2/memory/4724-134-0x0000000000400000-0x0000000002AF9000-memory.dmp	family_taurus_stealer
behavioral2/memory/4724-135-0x00000000001C0000-0x00000000001F8000-memory.dmp	family_taurus_stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b797a47861749b5269ac8853742b0ef7ee5739cc450480c82bafaaa270ed87b7.exe
"C:\Users\Admin\AppData\Local\Temp\b797a47861749b5269ac8853742b0ef7ee5739cc450480c82bafaaa270ed87b7.exe"
1⤵
PID:4724

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Query Registry

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/4724-132-0x0000000002C43000-0x0000000002C66000-memory.dmp

Filesize
140KB

Download
memory/4724-133-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download
memory/4724-134-0x0000000000400000-0x0000000002AF9000-memory.dmp

Filesize
39.0MB

Download
memory/4724-135-0x00000000001C0000-0x00000000001F8000-memory.dmp

Filesize
224KB

Download