shurk | bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394

General

Target

bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe
Size

731KB
MD5

d18f7a8f7b293e333b46ec6f70eea26c
SHA1

9470145dafae7b558782d90ce6e06f9e97dba8bc
SHA256

bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394
SHA512

f47d4ab9e0ea4f38d20829563f3203bfc0749351d9fd99fd0b61993ecb947621ce943211da39cdc6c78a9154fde6595dcf9119e2beda5b8d3daecf317e6ba078

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000122e3-62.dat	shurk_stealer
behavioral1/files/0x000a0000000122e3-63.dat	shurk_stealer
behavioral1/files/0x000a0000000122e3-64.dat	shurk_stealer
behavioral1/files/0x000a0000000122e3-65.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe
1572	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe

Loads dropped DLL 4 IoCs

pid	Process
1132	cmd.exe
932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe
932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe
932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1572	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1792	1988	bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe	27
PID 1988 wrote to memory of 1792	1988	bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe	27
PID 1988 wrote to memory of 1792	1988	bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe	27
PID 1988 wrote to memory of 1792	1988	bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe	27
PID 1792 wrote to memory of 1132	1792	WScript.exe	28
PID 1792 wrote to memory of 1132	1792	WScript.exe	28
PID 1792 wrote to memory of 1132	1792	WScript.exe	28
PID 1792 wrote to memory of 1132	1792	WScript.exe	28
PID 1132 wrote to memory of 932	1132	cmd.exe	30
PID 1132 wrote to memory of 932	1132	cmd.exe	30
PID 1132 wrote to memory of 932	1132	cmd.exe	30
PID 1132 wrote to memory of 932	1132	cmd.exe	30
PID 932 wrote to memory of 1572	932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe	31
PID 932 wrote to memory of 1572	932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe	31
PID 932 wrote to memory of 1572	932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe	31
PID 932 wrote to memory of 1572	932	SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe	31

C:\Users\Admin\AppData\Local\Temp\bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe
"C:\Users\Admin\AppData\Local\Temp\bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe
      SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe -pSsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\Users\Admin\AppData\Local\Temp\SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-54-0x0000000076BC1000-0x0000000076BC3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing