shurk | 568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb

General

Target

568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb.exe
Size

732KB
MD5

80a78957acf8c76491ec63b609047c13
SHA1

f9baa60988ce6be300184a38903b353d590b6ded
SHA256

568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb
SHA512

3fe59945343eeab85817b03e00a4104458404bd9af7fd467d442ddf8b674365f5b8ddbdca0ca0b1d84a28839b028a9fc6d7efdca664db182544cd6164447cbce

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0008000000015620-62.dat	shurk_stealer
behavioral1/files/0x0008000000015620-63.dat	shurk_stealer
behavioral1/files/0x0008000000015620-64.dat	shurk_stealer
behavioral1/files/0x0008000000015620-65.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe
684	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.exe

Loads dropped DLL 4 IoCs

pid	Process
1380	cmd.exe
616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe
616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe
616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
684	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 668	828	568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb.exe	27
PID 828 wrote to memory of 668	828	568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb.exe	27
PID 828 wrote to memory of 668	828	568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb.exe	27
PID 828 wrote to memory of 668	828	568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb.exe	27
PID 668 wrote to memory of 1380	668	WScript.exe	28
PID 668 wrote to memory of 1380	668	WScript.exe	28
PID 668 wrote to memory of 1380	668	WScript.exe	28
PID 668 wrote to memory of 1380	668	WScript.exe	28
PID 1380 wrote to memory of 616	1380	cmd.exe	30
PID 1380 wrote to memory of 616	1380	cmd.exe	30
PID 1380 wrote to memory of 616	1380	cmd.exe	30
PID 1380 wrote to memory of 616	1380	cmd.exe	30
PID 616 wrote to memory of 684	616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe	31
PID 616 wrote to memory of 684	616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe	31
PID 616 wrote to memory of 684	616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe	31
PID 616 wrote to memory of 684	616	SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe	31

C:\Users\Admin\AppData\Local\Temp\568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb.exe
"C:\Users\Admin\AppData\Local\Temp\568d57010dccfb07b197bf77fbdc499c37d8addbc411da6e5725ea20714906cb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe
      SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.sfx.exe -pSSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:616
    - - C:\Users\Admin\AppData\Local\Temp\SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SSSSSSDpDooqaDKoAFpASDFKpklSAFpsSSsSSS.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/828-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing