shurk | 1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347

General

Target

1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe
Size

6.4MB
MD5

5b8ca4452a18ad1b518fcaf80d5d71fb
SHA1

432b84e875658bfe8536fe86dbc7046565495a24
SHA256

1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347
SHA512

6ccc0bb2e9b075c260982bce6a1731ea9f2804203b4e67bb6340fe9397b332feef41dcaa851d6e205cebe986f0218e10332d69c01d66b666263a48b3135de46f

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 3 IoCs

resource	yara_rule
behavioral2/memory/600-127-0x0000000000400000-0x000000000047D000-memory.dmp	shurk_stealer
behavioral2/memory/600-133-0x0000000000447980-mapping.dmp	shurk_stealer
behavioral2/memory/600-134-0x0000000000400000-0x000000000047D000-memory.dmp	shurk_stealer

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral2/memory/2640-123-0x00000000003B0000-0x0000000000F2E000-memory.dmp	vmprotect

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2640	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 600	2640	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	69

Suspicious behavior: EnumeratesProcesses 6 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 600	2640	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	69
PID 2640 wrote to memory of 600	2640	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	69
PID 2640 wrote to memory of 600	2640	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	69
PID 2640 wrote to memory of 600	2640	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	69
PID 2640 wrote to memory of 600	2640	1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe	69

C:\Users\Admin\AppData\Local\Temp\1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe
"C:\Users\Admin\AppData\Local\Temp\1256bf2bd1e32727eb158c22208864325f73a00dba20d71d17f5703c3fc1e347.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:600

memory/600-127-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/600-134-0x0000000000400000-0x000000000047D000-memory.dmp

Filesize
500KB

Download
memory/2640-115-0x00000000015F0000-0x00000000015F1000-memory.dmp

Filesize
4KB

Download
memory/2640-116-0x0000000001600000-0x0000000001601000-memory.dmp

Filesize
4KB

Download
memory/2640-117-0x0000000001620000-0x0000000001621000-memory.dmp

Filesize
4KB

Download
memory/2640-118-0x0000000001630000-0x0000000001631000-memory.dmp

Filesize
4KB

Download
memory/2640-119-0x0000000001640000-0x0000000001641000-memory.dmp

Filesize
4KB

Download
memory/2640-120-0x0000000001650000-0x0000000001651000-memory.dmp

Filesize
4KB

Download
memory/2640-122-0x0000000001970000-0x0000000001971000-memory.dmp

Filesize
4KB

Download
memory/2640-123-0x00000000003B0000-0x0000000000F2E000-memory.dmp

Filesize
11.5MB

Download
memory/2640-126-0x0000000001660000-0x0000000001661000-memory.dmp

Filesize
4KB

Download