Analysis

  • max time kernel
    123s
  • max time network
    138s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    29-12-2021 13:57

General

  • Target

    74092ed53b8950bef5b21cd6c91a217ce470c566ba5cc3035e4ee7ef1ca8d216.exe

  • Size

    1.8MB

  • MD5

    6c6e76d71006c755fc2fee38fc08e109

  • SHA1

    2b77a52e4c1cae8ba6cf952a6d9b664e729231ea

  • SHA256

    74092ed53b8950bef5b21cd6c91a217ce470c566ba5cc3035e4ee7ef1ca8d216

  • SHA512

    ec3a9d2716fb1bb0fb3cdd55464fa91bce0abbf24ab539f90dbc3bb723781b98c64ce423c2fbba1666be49d192c75fce9033288a6ce80726fc2a6b2e77bda21b

Malware Config

Signatures

  • Shurk

    Shurk is an infostealer, written in C++ which appeared in 2021.

  • Shurk Stealer Payload 3 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\74092ed53b8950bef5b21cd6c91a217ce470c566ba5cc3035e4ee7ef1ca8d216.exe
    "C:\Users\Admin\AppData\Local\Temp\74092ed53b8950bef5b21cd6c91a217ce470c566ba5cc3035e4ee7ef1ca8d216.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:436

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/436-119-0x0000000002530000-0x0000000002590000-memory.dmp

    Filesize

    384KB

  • memory/436-118-0x0000000000400000-0x0000000000820000-memory.dmp

    Filesize

    4.1MB

  • memory/436-120-0x0000000000400000-0x0000000000820000-memory.dmp

    Filesize

    4.1MB

  • memory/436-121-0x0000000000400000-0x0000000000820000-memory.dmp

    Filesize

    4.1MB

  • memory/436-122-0x00000000028A0000-0x00000000028A1000-memory.dmp

    Filesize

    4KB

  • memory/436-123-0x00000000028B0000-0x00000000028B1000-memory.dmp

    Filesize

    4KB

  • memory/436-124-0x0000000002860000-0x0000000002861000-memory.dmp

    Filesize

    4KB

  • memory/436-128-0x00000000028F0000-0x00000000028F1000-memory.dmp

    Filesize

    4KB

  • memory/436-127-0x0000000002880000-0x0000000002881000-memory.dmp

    Filesize

    4KB

  • memory/436-126-0x0000000002890000-0x0000000002891000-memory.dmp

    Filesize

    4KB

  • memory/436-125-0x00000000028D0000-0x00000000028D1000-memory.dmp

    Filesize

    4KB

  • memory/436-129-0x00000000028C0000-0x00000000028C1000-memory.dmp

    Filesize

    4KB

  • memory/436-130-0x0000000003590000-0x0000000003591000-memory.dmp

    Filesize

    4KB

  • memory/436-132-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-131-0x0000000000400000-0x0000000000820000-memory.dmp

    Filesize

    4.1MB

  • memory/436-133-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-134-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-135-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-137-0x0000000002690000-0x0000000002691000-memory.dmp

    Filesize

    4KB

  • memory/436-136-0x0000000002520000-0x0000000002521000-memory.dmp

    Filesize

    4KB

  • memory/436-138-0x00000000024E0000-0x00000000024E1000-memory.dmp

    Filesize

    4KB

  • memory/436-147-0x0000000002810000-0x0000000002811000-memory.dmp

    Filesize

    4KB

  • memory/436-146-0x00000000027A0000-0x00000000027A1000-memory.dmp

    Filesize

    4KB

  • memory/436-145-0x00000000027F0000-0x00000000027F1000-memory.dmp

    Filesize

    4KB

  • memory/436-148-0x00000000027D0000-0x00000000027D1000-memory.dmp

    Filesize

    4KB

  • memory/436-144-0x00000000027E0000-0x00000000027E1000-memory.dmp

    Filesize

    4KB

  • memory/436-143-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-142-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-141-0x00000000026D0000-0x00000000026D1000-memory.dmp

    Filesize

    4KB

  • memory/436-140-0x00000000026B0000-0x00000000026B1000-memory.dmp

    Filesize

    4KB

  • memory/436-139-0x0000000002500000-0x0000000002501000-memory.dmp

    Filesize

    4KB

  • memory/436-150-0x0000000002840000-0x0000000002841000-memory.dmp

    Filesize

    4KB

  • memory/436-149-0x00000000027C0000-0x00000000027C1000-memory.dmp

    Filesize

    4KB

  • memory/436-155-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-154-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-153-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-152-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-151-0x0000000003580000-0x0000000003581000-memory.dmp

    Filesize

    4KB

  • memory/436-157-0x0000000002950000-0x0000000002951000-memory.dmp

    Filesize

    4KB

  • memory/436-156-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/436-161-0x0000000002940000-0x0000000002941000-memory.dmp

    Filesize

    4KB

  • memory/436-159-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/436-158-0x0000000002960000-0x0000000002961000-memory.dmp

    Filesize

    4KB

  • memory/436-160-0x0000000002980000-0x0000000002981000-memory.dmp

    Filesize

    4KB

  • memory/436-162-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/436-163-0x00000000029A0000-0x00000000029A1000-memory.dmp

    Filesize

    4KB

  • memory/436-165-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/436-166-0x0000000002990000-0x0000000002991000-memory.dmp

    Filesize

    4KB

  • memory/436-164-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/436-167-0x00000000026E0000-0x00000000026E1000-memory.dmp

    Filesize

    4KB

  • memory/436-169-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB

  • memory/436-168-0x00000000024D0000-0x00000000024D1000-memory.dmp

    Filesize

    4KB