Overview

overview

10

Static

static

1

KMSpico.exe

windows7-x64

10

KMSpico.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KMSpico.exe

  • Size

    4.5MB

  • Sample

    230517-se7epafd94

  • MD5

    d8d65c1beee8b951d1c798a4f5f6aa9f

  • SHA1

    c6527763cd63bc01cf097f9f3670f0d2c1a3c54d

  • SHA256

    6d2d0496dc172b3ae5dc0049c22b8541064ac04faff3140018ba6abc760026ad

  • SHA512

    a81156a9021d81b735bd3e9324f57709390a8c87ef521d849f4c8a310f61229659fdc061fa3a06d4cd1e1f67832decf7d120fc4e5d2bd8a192ddc79f14f49a57

  • SSDEEP

    98304:Hb9ajThszeFZURxHuuUksk0NOs1aCKkJLFxmU7w5CCDzlU22iMDd5lyOVT:HZ2uzw6xOZrxQCK2ic8CCDzl52iMjlyM

Score
10/10
taurusdiscoverypersistencespywarestealertrojanupx

Malware Config

Targets

    • Target

      KMSpico.exe

    • Size

      4.5MB

    • MD5

      d8d65c1beee8b951d1c798a4f5f6aa9f

    • SHA1

      c6527763cd63bc01cf097f9f3670f0d2c1a3c54d

    • SHA256

      6d2d0496dc172b3ae5dc0049c22b8541064ac04faff3140018ba6abc760026ad

    • SHA512

      a81156a9021d81b735bd3e9324f57709390a8c87ef521d849f4c8a310f61229659fdc061fa3a06d4cd1e1f67832decf7d120fc4e5d2bd8a192ddc79f14f49a57

    • SSDEEP

      98304:Hb9ajThszeFZURxHuuUksk0NOs1aCKkJLFxmU7w5CCDzlU22iMDd5lyOVT:HZ2uzw6xOZrxQCK2ic8CCDzl52iMjlyM

    Score
    10/10
    taurusdiscoverypersistencespywarestealertrojanupx

    • Taurus Stealer

      Taurus is an infostealer first seen in June 2020.

      trojanstealertaurus

    • Taurus Stealer payload

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses 2FA software files, possible credential harvesting

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

New Service

1
T1050

Scheduled Task

1
T1053

Privilege Escalation

New Service

1
T1050

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Tasks