taurus | 0e362e064fca6127dff2f0b52d55343494ed661e54aafad7ee923545974ec2e1

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 04:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f1d580624cc7159b639bb65686efbba.exe
Size

932KB
MD5

0f1d580624cc7159b639bb65686efbba
SHA1

53415dcbf70f15094af36a3694579b8027019310
SHA256

0e362e064fca6127dff2f0b52d55343494ed661e54aafad7ee923545974ec2e1
SHA512

01f349e40fb7e8ca9ef874cfdb48c776f17760618dbbc37d756e4e9dbb446d55e0fbad5c8848fa5845341a916b3f4ad0f30be9197505a80ea35b7afdc7de98f7
SSDEEP

12288:TfMa+NXT+Nl+NeE+N3E+NB9E+NIE+N6+Nh+N/+Nh+NQ+NE+NX+Nv+Ny+NX+NZ+NL:4VWrh3LXkuE67Ee8/RjP4T

Score

10^/10

taurus stealer trojan

Malware Config

Signatures

Taurus Stealer
Taurus is an infostealer first seen in June 2020.
trojan stealer taurus

Taurus Stealer payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2724-7-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-9-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-11-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-13-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-17-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer
behavioral1/memory/2724-19-0x0000000000400000-0x000000000043B000-memory.dmp	family_taurus_stealer

Suspicious use of SetThreadContext 1 IoCs

Processes:

0f1d580624cc7159b639bb65686efbba.exe

description pid process target process

PID 1332 set thread context of 2724 1332 0f1d580624cc7159b639bb65686efbba.exe 0f1d580624cc7159b639bb65686efbba.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2796 2724 WerFault.exe 0f1d580624cc7159b639bb65686efbba.exe

description	pid	process	target process
PID 1332 set thread context of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe

pid	pid_target	process	target process
2796	2724	WerFault.exe	0f1d580624cc7159b639bb65686efbba.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

0f1d580624cc7159b639bb65686efbba.exe0f1d580624cc7159b639bb65686efbba.exe

C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
"C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1332

C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe
"C:\Users\Admin\AppData\Local\Temp\0f1d580624cc7159b639bb65686efbba.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 92
3⤵
- Program crash
PID:2796

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-0-0x0000000000240000-0x000000000032E000-memory.dmp

Filesize
952KB

Download
memory/1332-1-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/1332-2-0x0000000005080000-0x00000000050C0000-memory.dmp

Filesize
256KB

Download
memory/1332-3-0x0000000000610000-0x0000000000658000-memory.dmp

Filesize
288KB

Download
memory/1332-20-0x0000000073FA0000-0x000000007468E000-memory.dmp

Filesize
6.9MB

Download
memory/2724-7-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-6-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-9-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-11-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-13-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-15-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2724-17-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-19-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download
memory/2724-4-0x0000000000400000-0x000000000043B000-memory.dmp

Filesize
236KB

Download

description	pid	process	target process
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 1332 wrote to memory of 2724	1332	0f1d580624cc7159b639bb65686efbba.exe	0f1d580624cc7159b639bb65686efbba.exe
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	WerFault.exe
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	WerFault.exe
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	WerFault.exe
PID 2724 wrote to memory of 2796	2724	0f1d580624cc7159b639bb65686efbba.exe	WerFault.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads