Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-03-2024 09:08
Static task
static1
Behavioral task
behavioral1
Sample
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe
Resource
win7-20240221-en
General
-
Target
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe
-
Size
339KB
-
MD5
85d26f599f100e876542f3977e8539c5
-
SHA1
82289e92aa61b145b7c966293acfd0cb9ab9d5db
-
SHA256
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3
-
SHA512
322cd8ab595fa5b6dbfe5ce0b720f41d18d1a4917cd43e373b62669c51b41397d8aab811f577e325d0bf54474ca5db5cd1ea1979de9ddfabd0148ad081c32f4b
-
SSDEEP
6144:l98cADCn51AMvn52ReDSjYHXCCY+4umkxmHRjsz6:/n7AI5HQYHXCzVumGmxgz6
Malware Config
Signatures
-
Taurus Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2716-4-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2716-7-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2716-8-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer behavioral1/memory/2716-9-0x0000000000400000-0x0000000000437000-memory.dmp family_taurus_stealer -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exedescription pid process target process PID 1328 set thread context of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exedescription pid process Token: SeDebugPrivilege 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exedescription pid process target process PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe PID 1328 wrote to memory of 2716 1328 a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe"C:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exeC:\Users\Admin\AppData\Local\Temp\a1a258c9e2751e7d0906c64e27d5999ab380017639fc97d49dc1c0df3a2c3ea3.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-0-0x0000000001310000-0x0000000001368000-memory.dmpFilesize
352KB
-
memory/1328-1-0x0000000073ED0000-0x00000000745BE000-memory.dmpFilesize
6.9MB
-
memory/1328-2-0x00000000003A0000-0x00000000003E0000-memory.dmpFilesize
256KB
-
memory/1328-3-0x0000000000380000-0x00000000003A2000-memory.dmpFilesize
136KB
-
memory/1328-6-0x0000000073ED0000-0x00000000745BE000-memory.dmpFilesize
6.9MB
-
memory/2716-4-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2716-7-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2716-8-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB
-
memory/2716-9-0x0000000000400000-0x0000000000437000-memory.dmpFilesize
220KB