shurk | 2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346

Analysis

max time kernel
4294199s
max time network
153s
platform
windows7_x64
resource
win7-20220310-en
submitted
28-03-2022 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
Size

732KB
MD5

fb79729e325c9615648e2298ad535bc8
SHA1

29e07592fd1a162d8bc77078930c761e4da61a7e
SHA256

2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346
SHA512

74b9a601076e54f58eea5d4d87d1a2e4246ead09e26d5c0574e9f03def030266474c2ac11013d666ddbf30559b49bee6ddc7b9067fd13c945dd3ff97a7544349

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000014b3e-65.dat	shurk_stealer
behavioral1/files/0x0007000000014b3e-66.dat	shurk_stealer
behavioral1/files/0x0007000000014b3e-67.dat	shurk_stealer
behavioral1/files/0x0007000000014b3e-69.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
1580	xlodersbekinglooka.sfx.exe
1900	xlodersbekinglooka.exe

Loads dropped DLL 4 IoCs

pid	Process
1144	cmd.exe
1580	xlodersbekinglooka.sfx.exe
1580	xlodersbekinglooka.sfx.exe
1580	xlodersbekinglooka.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1900	xlodersbekinglooka.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1608	740	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	27
PID 740 wrote to memory of 1608	740	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	27
PID 740 wrote to memory of 1608	740	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	27
PID 740 wrote to memory of 1608	740	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	27
PID 1608 wrote to memory of 1144	1608	WScript.exe	28
PID 1608 wrote to memory of 1144	1608	WScript.exe	28
PID 1608 wrote to memory of 1144	1608	WScript.exe	28
PID 1608 wrote to memory of 1144	1608	WScript.exe	28
PID 1144 wrote to memory of 1580	1144	cmd.exe	30
PID 1144 wrote to memory of 1580	1144	cmd.exe	30
PID 1144 wrote to memory of 1580	1144	cmd.exe	30
PID 1144 wrote to memory of 1580	1144	cmd.exe	30
PID 1580 wrote to memory of 1900	1580	xlodersbekinglooka.sfx.exe	31
PID 1580 wrote to memory of 1900	1580	xlodersbekinglooka.sfx.exe	31
PID 1580 wrote to memory of 1900	1580	xlodersbekinglooka.sfx.exe	31
PID 1580 wrote to memory of 1900	1580	xlodersbekinglooka.sfx.exe	31

C:\Users\Admin\AppData\Local\Temp\2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
"C:\Users\Admin\AppData\Local\Temp\2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe
      xlodersbekinglooka.sfx.exe -pxlodersbekinglooka.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bat.bat

Filesize
71B

MD5
d5cf377004f27f65558c383447d541f0

SHA1
3b413e653c0241256910982c79671e386dc81d28

SHA256
b87bf7396cb151b064a0ca8169dbe925d8afebd5878e5f5495a043f1f44f2243

SHA512
9dd1ed91cbf02c48fa7c5821d995dac8b71eab7afc9597a074277f1140ccdda5e86f5680914b2c8d5bfa97d3745f3135d0f8c8cafc11ab2355f3f7ae9dd4fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbs.vbs

Filesize
89B

MD5
dc06d3c7415f4f6b05272426a63e9fd1

SHA1
2a148ec726cde2a19222c03ebf2cf48e8a5c171f

SHA256
101467d0422de2fafce3dc4e7f28343f7eab7f132a42843a9498b0fe3ffa9093

SHA512
d2063eddd861715db497adaf3440fc120aed019aa309ca2010d7b19e26987648c67f590e141df31b7c660cfebb33f052861fa2d1db5017e5f97dd4437155f76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe

Filesize
501KB

MD5
7828d59e8aad70882bb3950cb4a0f27d

SHA1
2aa02d7b66cb342794b74e056ba960f9181dfb47

SHA256
cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35

SHA512
1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe

Filesize
568KB

MD5
f674d0b20b39dcb63eb0c9b576dfa3c0

SHA1
03b1d9ecff1124d0ff499148ed36ee51e3eed4c2

SHA256
698e7886f9babb58f2093bdf232652feeb1db319f9235ce5ce096d818cb13652

SHA512
92db404340b169c24a81db4e74b99a87d0471e1623d49d84ef1dc4323fc9fcc440fbe671d1a9cc9af1e0ea81117f2c08912b2b6ed0543b5b8b1ae50f99fb843e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe

Filesize
568KB

MD5
f674d0b20b39dcb63eb0c9b576dfa3c0

SHA1
03b1d9ecff1124d0ff499148ed36ee51e3eed4c2

SHA256
698e7886f9babb58f2093bdf232652feeb1db319f9235ce5ce096d818cb13652

SHA512
92db404340b169c24a81db4e74b99a87d0471e1623d49d84ef1dc4323fc9fcc440fbe671d1a9cc9af1e0ea81117f2c08912b2b6ed0543b5b8b1ae50f99fb843e

Download Submit
\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe

Filesize
501KB

MD5
7828d59e8aad70882bb3950cb4a0f27d

SHA1
2aa02d7b66cb342794b74e056ba960f9181dfb47

SHA256
cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35

SHA512
1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd

Download Submit
\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe

Filesize
501KB

MD5
7828d59e8aad70882bb3950cb4a0f27d

SHA1
2aa02d7b66cb342794b74e056ba960f9181dfb47

SHA256
cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35

SHA512
1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd

Download Submit
\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe

Filesize
501KB

MD5
7828d59e8aad70882bb3950cb4a0f27d

SHA1
2aa02d7b66cb342794b74e056ba960f9181dfb47

SHA256
cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35

SHA512
1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd

Download Submit
\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe

Filesize
568KB

MD5
f674d0b20b39dcb63eb0c9b576dfa3c0

SHA1
03b1d9ecff1124d0ff499148ed36ee51e3eed4c2

SHA256
698e7886f9babb58f2093bdf232652feeb1db319f9235ce5ce096d818cb13652

SHA512
92db404340b169c24a81db4e74b99a87d0471e1623d49d84ef1dc4323fc9fcc440fbe671d1a9cc9af1e0ea81117f2c08912b2b6ed0543b5b8b1ae50f99fb843e

Download Submit
memory/740-54-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download