shurk | 794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf

General

Target

794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf.exe
Size

731KB
MD5

b9e1489d3bf19c77c3460a06169adc61
SHA1

686257133c5e52b71a864646faeb6e4b21e651e3
SHA256

794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf
SHA512

de38d10d56a6ab283bd19008dbc35873ffc8d6651be07cb36706a519b5d200586e202a5e2e741ccbfcf8d5a56ba7baa596bc8776e57d31f142512f0f52baa6dc

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0009000000013a8b-62.dat	shurk_stealer
behavioral1/files/0x0009000000013a8b-64.dat	shurk_stealer
behavioral1/files/0x0009000000013a8b-63.dat	shurk_stealer
behavioral1/files/0x0009000000013a8b-65.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
588	SpAldWoqkAJqoAsdFGBxS.sfx.exe
1228	SpAldWoqkAJqoAsdFGBxS.exe

Loads dropped DLL 4 IoCs

pid	Process
1116	cmd.exe
588	SpAldWoqkAJqoAsdFGBxS.sfx.exe
588	SpAldWoqkAJqoAsdFGBxS.sfx.exe
588	SpAldWoqkAJqoAsdFGBxS.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1228	SpAldWoqkAJqoAsdFGBxS.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 520	2000	794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf.exe	27
PID 2000 wrote to memory of 520	2000	794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf.exe	27
PID 2000 wrote to memory of 520	2000	794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf.exe	27
PID 2000 wrote to memory of 520	2000	794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf.exe	27
PID 520 wrote to memory of 1116	520	WScript.exe	28
PID 520 wrote to memory of 1116	520	WScript.exe	28
PID 520 wrote to memory of 1116	520	WScript.exe	28
PID 520 wrote to memory of 1116	520	WScript.exe	28
PID 1116 wrote to memory of 588	1116	cmd.exe	30
PID 1116 wrote to memory of 588	1116	cmd.exe	30
PID 1116 wrote to memory of 588	1116	cmd.exe	30
PID 1116 wrote to memory of 588	1116	cmd.exe	30
PID 588 wrote to memory of 1228	588	SpAldWoqkAJqoAsdFGBxS.sfx.exe	31
PID 588 wrote to memory of 1228	588	SpAldWoqkAJqoAsdFGBxS.sfx.exe	31
PID 588 wrote to memory of 1228	588	SpAldWoqkAJqoAsdFGBxS.sfx.exe	31
PID 588 wrote to memory of 1228	588	SpAldWoqkAJqoAsdFGBxS.sfx.exe	31

C:\Users\Admin\AppData\Local\Temp\794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf.exe
"C:\Users\Admin\AppData\Local\Temp\794c23dd8f2c86e3fb263e9e3f615551ef3a1183e7dc99e9eeea3faee47453bf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\SpAldWoqkAJqoAsdFGBxS.sfx.exe
      SpAldWoqkAJqoAsdFGBxS.sfx.exe -pSpAldWoqkAJqoAsdFGBxS.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\SpAldWoqkAJqoAsdFGBxS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SpAldWoqkAJqoAsdFGBxS.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2000-54-0x0000000074C61000-0x0000000074C63000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing