shurk | 1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347

General

Target

1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe
Size

6.4MB
MD5

5b8ca4452a18ad1b518fcaf80d5d71fb
SHA1

432b84e875658bfe8536fe86dbc7046565495a24
SHA256

1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347
SHA512

6ccc0bb2e9b075c260982bce6a1731ea9f2804203b4e67bb6340fe9397b332feef41dcaa851d6e205cebe986f0218e10332d69c01d66b666263a48b3135de46f

Score

10^/10

shurk infostealer vmprotect

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/memory/1368-83-0x0000000000400000-0x000000000047D000-memory.dmp	shurk_stealer
behavioral1/memory/1368-89-0x0000000000447980-mapping.dmp	shurk_stealer
behavioral1/memory/1368-90-0x0000000000400000-0x000000000047D000-memory.dmp	shurk_stealer
behavioral1/memory/1368-92-0x0000000000400000-0x000000000047D000-memory.dmp	shurk_stealer

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/980-78-0x0000000000D70000-0x00000000018EE000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 980 set thread context of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe
980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe
1368	AppLaunch.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27
PID 980 wrote to memory of 1368	980	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	27

C:\Users\Admin\AppData\Local\Temp\1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe
"C:\Users\Admin\AppData\Local\Temp\1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-54-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/980-55-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/980-56-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/980-57-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/980-58-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/980-59-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/980-61-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/980-62-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/980-64-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/980-65-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/980-67-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/980-68-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/980-71-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/980-70-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/980-73-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/980-72-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/980-75-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/980-76-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/980-77-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/980-78-0x0000000000D70000-0x00000000018EE000-memory.dmp

Filesize
11.5MB

Download
memory/980-81-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1368-82-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1368-83-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1368-90-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/1368-91-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1368-92-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download

Analysis

Sharing