Analysis
-
max time kernel
149s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
19-03-2022 12:27
General
-
Target
bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe
-
Size
731KB
-
MD5
d18f7a8f7b293e333b46ec6f70eea26c
-
SHA1
9470145dafae7b558782d90ce6e06f9e97dba8bc
-
SHA256
bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394
-
SHA512
f47d4ab9e0ea4f38d20829563f3203bfc0749351d9fd99fd0b61993ecb947621ce943211da39cdc6c78a9154fde6595dcf9119e2beda5b8d3daecf317e6ba078
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer Payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe"C:\Users\Admin\AppData\Local\Temp\bb09b23c49593c6b6d2f8d83a7d4e5d430ebcf1f394d0bb6a6f7872f293a8394.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c bat.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exeSsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.sfx.exe -pSsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe -dC:\Users\Admin\AppData\Local\Temp4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe"C:\Users\Admin\AppData\Local\Temp\SsGGAAssFFFggDDPPOOSSDDSSnanSnAKdA.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
-