Analysis
-
max time kernel
136s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
28-03-2022 13:55
General
-
Target
82bf6a19170c4f0f7499b65826bd529bbd5c5ca4c9de6aef795ee8caf92a40d2.exe
-
Size
5.5MB
-
MD5
110828c3586e434a516028fd3c4aec01
-
SHA1
5589cb49122f5ac9abf135641f1781219fe2e508
-
SHA256
82bf6a19170c4f0f7499b65826bd529bbd5c5ca4c9de6aef795ee8caf92a40d2
-
SHA512
17cab8f161db27c1028ac27cdecf35b216bfbc1e6babd6175bdd740d69b48e970060d22f0b8bf3cafb2717665c727b0cff44b1e3f8040f1a3a6b61a923ef0e27
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer Payload 2 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\82bf6a19170c4f0f7499b65826bd529bbd5c5ca4c9de6aef795ee8caf92a40d2.exe"C:\Users\Admin\AppData\Local\Temp\82bf6a19170c4f0f7499b65826bd529bbd5c5ca4c9de6aef795ee8caf92a40d2.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
5.5MB