Analysis
- max time kernel
142s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/03/2022, 02:25
General
- Target e2e6f768fdd68fdead6a86e1ad0cd5a42380ddb2ce6c1f4522be21bd55b04041.exe
- Size 6.1MB
- Sample220309-cwn2nsfbfn
- SHA256 e2e6f768fdd68fdead6a86e1ad0cd5a42380ddb2ce6c1f4522be21bd55b04041
Score
10/10
Malware Config
Signatures
- Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
- Shurk Stealer Payload 2 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2e6f768fdd68fdead6a86e1ad0cd5a42380ddb2ce6c1f4522be21bd55b04041.exe"C:\Users\Admin\AppData\Local\Temp\e2e6f768fdd68fdead6a86e1ad0cd5a42380ddb2ce6c1f4522be21bd55b04041.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1392-130-0x0000000001020000-0x0000000001021000-memory.dmp
memory/1392-131-0x0000000000610000-0x0000000000C2B000-memory.dmp
memory/1392-133-0x0000000000610000-0x0000000000C2B000-memory.dmp