shurk | 02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e

General

Target

02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e.exe
Size

732KB
MD5

05e7d8ed8b7301e8e4bf2a08aeef2e0a
SHA1

6b51a2ee1e058167de7877c4a6c4a6d2e1bed711
SHA256

02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e
SHA512

8eb45f9a947e51d8c6f4c76b04962c67df2b3b843975cc86231e0ad00ee3dcd7dcfdfdc97331ccf2900b76e0c619d4d4d8b73ffe17261b3fa297b3836b8be335

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x00070000000125b9-63.dat	shurk_stealer
behavioral1/files/0x00070000000125b9-64.dat	shurk_stealer
behavioral1/files/0x00070000000125b9-65.dat	shurk_stealer
behavioral1/files/0x00070000000125b9-66.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe
596	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.exe

Loads dropped DLL 4 IoCs

pid	Process
1360	cmd.exe
788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe
788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe
788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
596	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 996	1616	02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e.exe	27
PID 1616 wrote to memory of 996	1616	02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e.exe	27
PID 1616 wrote to memory of 996	1616	02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e.exe	27
PID 1616 wrote to memory of 996	1616	02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e.exe	27
PID 996 wrote to memory of 1360	996	WScript.exe	28
PID 996 wrote to memory of 1360	996	WScript.exe	28
PID 996 wrote to memory of 1360	996	WScript.exe	28
PID 996 wrote to memory of 1360	996	WScript.exe	28
PID 1360 wrote to memory of 788	1360	cmd.exe	30
PID 1360 wrote to memory of 788	1360	cmd.exe	30
PID 1360 wrote to memory of 788	1360	cmd.exe	30
PID 1360 wrote to memory of 788	1360	cmd.exe	30
PID 788 wrote to memory of 596	788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe	31
PID 788 wrote to memory of 596	788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe	31
PID 788 wrote to memory of 596	788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe	31
PID 788 wrote to memory of 596	788	SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe	31

C:\Users\Admin\AppData\Local\Temp\02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e.exe
"C:\Users\Admin\AppData\Local\Temp\02dc23d65a2d31b758defd3f43d5ba64dce3229ff4cdbf9cec5e63915ba4d20e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1360
  - - C:\Users\Admin\AppData\Local\Temp\SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe
      SpdoSPofdsafpASFPpasFkkdsfkokEFGg.sfx.exe -pSpdoSPofdsafpASFPpasFkkdsfkokEFGg.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:788
    - - C:\Users\Admin\AppData\Local\Temp\SpdoSPofdsafpASFPpasFkkdsfkokEFGg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SpdoSPofdsafpASFPpasFkkdsfkokEFGg.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing