taurus | 0e362e064fca6127dff2f0b52d55343494ed661e54aafad7ee923545974ec2e1

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 04:52

Target

0f1d580624cc7159b639bb65686efbba.exe
Size

932KB
MD5

0f1d580624cc7159b639bb65686efbba
SHA1

53415dcbf70f15094af36a3694579b8027019310
SHA256

0e362e064fca6127dff2f0b52d55343494ed661e54aafad7ee923545974ec2e1
SHA512

01f349e40fb7e8ca9ef874cfdb48c776f17760618dbbc37d756e4e9dbb446d55e0fbad5c8848fa5845341a916b3f4ad0f30be9197505a80ea35b7afdc7de98f7
SSDEEP

12288:TfMa+NXT+Nl+NeE+N3E+NB9E+NIE+N6+Nh+N/+Nh+NQ+NE+NX+Nv+Ny+NX+NZ+NL:4VWrh3LXkuE67Ee8/RjP4T

Score

10^/10

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2724-7-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-9-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-11-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-13-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-17-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-19-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1332 set thread context of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2796	2724	WerFault.exe	28

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	28
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	29
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	29
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	29
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	29

memory/1332-0-0x0000000000240000-0x000000000032E000-memory.dmp

Filesize
952KB

Download
memory/1332-1-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/1332-2-0x0000000005080000-0x00000000050C0000-memory.dmp

Filesize
256KB

Download
memory/1332-3-0x0000000000610000-0x0000000000658000-memory.dmp

Filesize
288KB

Download
memory/1332-20-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2724-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-6-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-9-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-11-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-13-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-15-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-17-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-19-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-4-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download