shurk | 0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b

General

Target

0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b.exe
Size

732KB
MD5

32f6f764b86b1a3ad33e2c1b66f691c6
SHA1

7baadaa212daf9fa2ef6646410cf28a8301b9db4
SHA256

0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b
SHA512

64ff433c41803196e88dd4de4825edac36a99a936600db350ac360c96f40532c8544006d6d4cf84c7d09158cf35d5e68995a9f828945fb000fee99081a23281f

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000122c1-62.dat	shurk_stealer
behavioral1/files/0x000a0000000122c1-63.dat	shurk_stealer
behavioral1/files/0x000a0000000122c1-64.dat	shurk_stealer
behavioral1/files/0x000a0000000122c1-65.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe
2000	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.exe

Loads dropped DLL 4 IoCs

pid	Process
860	cmd.exe
792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe
792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe
792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1448	1628	0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b.exe	27
PID 1628 wrote to memory of 1448	1628	0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b.exe	27
PID 1628 wrote to memory of 1448	1628	0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b.exe	27
PID 1628 wrote to memory of 1448	1628	0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b.exe	27
PID 1448 wrote to memory of 860	1448	WScript.exe	28
PID 1448 wrote to memory of 860	1448	WScript.exe	28
PID 1448 wrote to memory of 860	1448	WScript.exe	28
PID 1448 wrote to memory of 860	1448	WScript.exe	28
PID 860 wrote to memory of 792	860	cmd.exe	30
PID 860 wrote to memory of 792	860	cmd.exe	30
PID 860 wrote to memory of 792	860	cmd.exe	30
PID 860 wrote to memory of 792	860	cmd.exe	30
PID 792 wrote to memory of 2000	792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe	31
PID 792 wrote to memory of 2000	792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe	31
PID 792 wrote to memory of 2000	792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe	31
PID 792 wrote to memory of 2000	792	SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe	31

C:\Users\Admin\AppData\Local\Temp\0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b.exe
"C:\Users\Admin\AppData\Local\Temp\0cc485ab5c00ba95759d821215475fa2ef7d6e682cb53b97a3a7c90dd0d42c3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe
      SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.sfx.exe -pSopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:792
    - - C:\Users\Admin\AppData\Local\Temp\SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SopDPdfDSAaSDfgokaDSOpdSFoogFlgkdSMkOSkkFLskeF.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-54-0x00000000766A1000-0x00000000766A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing