shurk | 2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346

General

Target

2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
Size

732KB
MD5

fb79729e325c9615648e2298ad535bc8
SHA1

29e07592fd1a162d8bc77078930c761e4da61a7e
SHA256

2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346
SHA512

74b9a601076e54f58eea5d4d87d1a2e4246ead09e26d5c0574e9f03def030266474c2ac11013d666ddbf30559b49bee6ddc7b9067fd13c945dd3ff97a7544349

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000002062a-143.dat	shurk_stealer
behavioral2/files/0x000500000002062a-142.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
64	xlodersbekinglooka.sfx.exe
4264	xlodersbekinglooka.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	xlodersbekinglooka.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00180008201401B1 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000002986c144e71db024f0eed4ffc35e015103c63e18539458202e31e826c0c2660f000000000e800000000200002000000099184dfa9b090666eda30af113a22bbe4840b6dd9ddf24f02b2c16025d830caf8000000007ead54a327b3474dfeb93e45a3e74c0354287e269282a1ee7f763450dbaa57104a192580a81b9f3586362fa6770e32008bfec24a7a7e91784618dc25143b349a8515de23bfd243cc4c2cf96285ecf3e3a8b1ec78915a506be9a2c9fec8e27a7d09514e4f5ebe3a0742e692b2c47bf9f16e5d8706894e398db960f93547fb14040000000cc3afc6e6e516817ed3cdc28f93ad4e98f45d1f40a0aff15e790f4b08bb3a81b10c2c3111317a1cd66552a7cf22b1cb2408e4274dc5cc4dd5cb8f3b88970f8be	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000000266db778e68e6a81f1b95492390407452467318541ce739aaec8ab0175d3aae000000000e800000000200002000000064d3576025a7c342cbfc1630757e1940d969366ab9a88972b97df0e5aadd7869100d00007ed706f56e3ef34c566b1bd533f09fbc878fe1a83313282214fb4aa1fad83df2e51697c15c85b4e0aff5ba0abc89b1509fa286e112e6d21f909ece478731e9a5549f570551f5b719b72b47983714ba1a1745cf9c3457de76ce2bf25041ce34fcc0d05e3f6c326d7fe8930aa2cfa6a2caad88ff79e5e2cb2e741008db8654be26ae60aa1878a80e870163ac1e48497ef924c4f867214428402dbac2be4d3a8d8cb93e3bce16f662d8c1dd9eb3dcc71e9a3e5160f3ccd86aa3d27e8490dd6227572ca2cec87f0812fc8b51b1e971ac0f7576f63d494055c0e07ef257c7994bf73ea18c93ae127990ddbfde6514c71ecef7d86f33297d848984a3b1e971b21fd7c15f053fd2fd5841afe1c3c27bac8b28cb7b751856a62e3df92298dfc541a7c5d804757c0191d47bb44926e36af4793df456c6d8212ad8596bdd3b5ec6be9f15085d7cb9ea96614009f11967fd992c02dbf6e23379dc954b09153079ecdc5a547a76324cf022a1a7be9f16a8d692e20cb6cdadc443c9dfb5540eaf3785108aafd0b58633707c36ba9f1cf899b2a227343d52527bd056cd4842335ae26a653437da4a93a2f1f8ec55944962e47f0b6d8f9c738a824778c14a03763cdf78aebfd5251d773e454d1b78a0fc6da0730a0bcd68755537f9ef165dabc7098250f0250eafe3b9f6eaf37ed069202a2a371aff0f63f8c5d36c0fc857d391962164ec8f6616ef8c8c9fabd91808bdc2447eb3019e72be9481d0af70c7369486642bceb5d45f3bd2ec383935739a9ffadcb390cd5b999d79fa471b68a5f18f3c5277ac09eafad64dcb1c440ccb5de7bea2565443e8abfb3f672bb31c73c708fa3bcfc7f27b31af3444925626327832ea7abb1d8c914aaaa86091426b962cfe93d87adf1de8a1b4575b3adeea7e1cc506fbe8462475b1c78b58efd4c2893d2569ce759b7c30a9a4ad93911a8614945266bfd0eb160ea4a32c5c42b754db7a4a52d269c854e2ce13749adbc6b78a5bf40b3dee38106a196e2f8d9f54460037233a034c45c2e588c6438c3ea1e6e8e7d84c8dfc54249b83fe6a1d73735957e0fd5e211bb980a4cddb24cea691e40344ae31b184516bc96b567a941b452e9e2d5db77a41fb84682d47c14da742a2f7126625e0045580fb02dd91ba672b8aff9623b9ff6285316587224438d53e6f4f7d6ca946e760b7aa2f9efad910aafe05d486cc36d3e2781e946e9b4bf458e71e6a5680b343dee877d668daa00c3e3891a28e3629b2a13c54bfeb19d8e5bf6e2cd70f110266c8404e12bc5d6067da808127b1572cee3ab8bdf14897bc8089fe0920e02c644de7e2b992f309ee7f468e15296c17089795fed494bdd9bba5eacae5341829dd69e9c7ce4cad08942d946d3f9530cba79c2d677b5112f14ad5ce0316e1ae4ec261fc01ab0bf4b079a2e0ea59fdf5fef73003e48a5c2cc332e0c7b3ef4bc3323db3bfa44a54bf0f5de71178bfb4be3b8db054f47a494441ebaef5d2007d9836215e9647d6fa8506e6cb2e1e15938c4437e95de93c7c03f82fca5c2955cd7ea5789a375ffcd3cae97618907ddb5a2795a9da242f8e22e5f8cb213ecc16aee9debd870469d3369b227d4f4f40925ef09d01654f95be4740c444aa1a6674a29d9862c31ef122bac0c86acc8e16edd1569f37f59156383e42ea21af6b4d72baee906b56b1cc9e61c0a47b0fe512633102857d5a678c0ad388c6c566af259988471a2d1b0ceae1d3f6f7cde338dde4ed372265f600892a7da10d1250b11c8154df695979a6020e84bbfac54939ecdb830d93e66832b31a0dea1efa5a5424e17a7c10a08c60f9a538874f2395bae8e63b374efba248b8c74fe396cbc61abcfab56cc94b35ac88dace48f533c919f07631ebb86a16f70279befaeb63f4ea770c2ec8c6428532f18a4a3208a5f5be2da0fafe1f6ed8cc769e9f88b33d8fbef9c4371b4384596939735fe8e6fd8bfcb99c2bc6c726bc8244b3a9f53c8ae500742a66cc2871a3fb85d13f693850a255440edda83e6cb168f48665faa4460100abbfcfabd32286ab2590f1ff8dc3db314d28bd74d3049b41aff7a110e813c87ea95c121819d08edcdd78e83293bc1c4462c341b7f246642496e51e92b6555f6d5328495b6a2b33b96840d569249b949c400017fdd5813982e5cfe9582c15bc57deb6f6cf2caec812e5363f663501adea2646d36d60c45f13b3aab251e18f13138b4a5bc1c8b5b0391cb0468de623412924bd28d810ce5ab9ac89b7a57e8883a46667dcd5106c6da4c2032ed88c543d2d5eac315fc696ba1ec8c4c351da3eb15ecb29d1fed9e362f3b067a94df810d1f6c30809bc94ce3a9541c8aee0508c15f19f925e6f0c580b1a9d9edba6801a4a73e3ebb7a8e1ea6b50b33146e290993f859595f8861ec71203c740af944f4cafb8e006ed5149b3673dec59239958bba1434aa73ad30f49d6184a3856656356a6e6ad09e8bbde92bf006de1db5c3f6f23af9fd67b35b0d2e3e3417b995bbab314a17d375094e454b379c979b4553aaa0f4f69a3622987fdc6a99577387ab838898129064c710b726f0b637c1be7667377a57e83815e5d7b3ef26e4f913e6bb9b4d8967e20807a6322652e2a436b6e4eaef52223baf0a217c4ac7acf280e49372a1656c0f478183561b30f89368abfacf7ec3bfa3b97bd69e69f3d2c854b0a6560e691b3e8082f93415b932ff46bef965a0897a50c78d547d8ae6b2f271269065c174c5a12739a4199f5e46ba410afa30984c2d7cb9864e631eae96ae649484c0334305213e7a10ccd45a8764c80508ea7f4567727ffbf29a9a26d2ca9a1c0ff135bbc0b14dda1bcda8c9b1a18bb62037ace2e3d9010393a47cbb2cd926fc9f0bdab8b1f81e6b5c1ba773ea83a3f6e6f9e319a7e9814ad6eb18bab7c22b8dd9fa19adc6a184dac78a78e1ce192042b72169b44ba9166f0870414d457208231359a7ffb5a17e841b808f3ad9a850db5776eb465264916facee549acca8fd39215e8c66b0060a8c42b8ceaaf27ccd5adea1b851f6d916fdc53406f2863089fc1a5891f8aa04b74b8cb8edefb68ac0db9bb8ad350c58c4b393f234cb320c1c01f9bd3167a1a7c02f195a92a80dfd0c709ee2870274560effcb4f6a320d1527c5c8d76bea83d180f5f41cb56466209b2df8e9d6f1370af8da12f6c2fd93e1da07554e50b9763aeccc134dea65a702711b4a9f183fe7b5fed8b500aeceae18454046cc89ce619ea2d82531f3f55bd91f51d2a5eb29a7b6f7520b71339b74c1ccd17a084c7cefd9541cc3360f6e47cb3deac92b98fe0983da375b7fa15de386bd49312dc2190c5aee81359f426b2f438d6bf1f72592ae704ee972474b9bec280fb6d5bbe54725dc0ed048051be227c57516d40c7e6d8d725011e5a428fab9ebdd18270c7a453e63614444492bf9de53545e4e1dd23771b69ab9c9f24374880fa1b0c0827c2327a872246edf3d282c1d586a6ea27c05f9ca23f178e581de086c897a9c41ca3a790e56d315425a023623abe8f00c9227c90c19dd2a52c1afdb75b13b32cc2abd9bb6f82083b12c91d9b1baec6157088d8527cf97ac45ab9b87ce53f5c5674cd9a81248e7b92461be47afc0df2946dae402965da76f9c4a3f696466f495563d2d952ffc01e1055c8c4e7a6d5def8a06984379c1cf466d2f7125d1bd84ce210552bc8667e142b20ce2f2684aaba1bee99ca6f5a754aaadecce65f1288fc581520464f6f545c25b57f0e787252c7b0353bb8b601086ddc667a8065138df75528b2b9fe13d7d75510213780cc8316d8756c9fb458c930f63169833bfa1769166ad28d3ce9838589808bf11b7e278df1c10851224068c46e30dd6c35e5c2c21f2f3ee80b6e9e4dd66eef8afe1c38892a88a95a0329f20497e732d11198b0477bc6d42af6863f6aa6a454505eab557ce491fafd3b7acd92120589d96af9f8c7d74ae73b77d74e47509c823f80ebc093f4ad3cabcad435c6a3d56dcb320282af1cb6156f73f7599afdd0da451e1967ecfcc6143f3b715c729f1aac4616340be9e0cc0850f2d66c974a37a7d53dd840dc83f01b598b09308af989ac464907e509d06a8b0c0ecf7bfb2924e49ce2fbee0cfb0813e5262475d56bd330c14df5cb9922ef3430e12dd9571732ea4897532369f36f3b08508563dd5bc8cc76e98657d19387971a0320d7c85416d7c007c462e2255841e2507dfae07792a0c46c66fc68d571b1a19dc0bcec399bb0b42b6a0a46af4e7badfc118ec12753832f81e4836c8ce9424bda256bc9ac9586ae95b45676beb1ec86f6f7bece7c5d1a17fc4eeebb24e034c287600a3ea3a94a689f1097f2cd922e47782cc5b803375f39f29b987175b980f28cf8d49dfbd0cd752ec72589723aa5f176933349bb337ecc01f365e54d8a230e25c4833290de4b2e3e52c7ee2e4e14e2d5c2775b1c85638d1a0de016c14b4269aa7154b9ec82fdd85106c7c65fd473dd84341fc0962444835f301624a44d374f440b3abd5d44e855df8c847c5d42a6ce29df5e26b7de7e33c610a926c8f1eaf44cca42a91a3ae5461cd8a247980d0c371a77d7b053d5474d8f3ba7a05309e318ec6fd06eb3e10171db75abe4f288250e4f20302d6a27e343c80df2521577019330096aa528b568f2334613317d2ef566ac91171bff5ec6bb211ae02f79ef72f7f68c15559d59495a4cbd5f1c5160c3d6e8105825ba87395c18ba40000000d96bfc01594332c0d2bd865ca03ea2398b73615b2e20d84b0cb9b3ab505811245aa662cd82234f28edfdb08e7f596929665370ae5525bcfafffe56bc9ad12680	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00180008201401B1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4264	xlodersbekinglooka.exe
4264	xlodersbekinglooka.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1092	3492	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	85
PID 3492 wrote to memory of 1092	3492	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	85
PID 3492 wrote to memory of 1092	3492	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	85
PID 1092 wrote to memory of 1480	1092	WScript.exe	86
PID 1092 wrote to memory of 1480	1092	WScript.exe	86
PID 1092 wrote to memory of 1480	1092	WScript.exe	86
PID 1480 wrote to memory of 64	1480	cmd.exe	88
PID 1480 wrote to memory of 64	1480	cmd.exe	88
PID 1480 wrote to memory of 64	1480	cmd.exe	88
PID 64 wrote to memory of 4264	64	xlodersbekinglooka.sfx.exe	89
PID 64 wrote to memory of 4264	64	xlodersbekinglooka.sfx.exe	89
PID 64 wrote to memory of 4264	64	xlodersbekinglooka.sfx.exe	89

C:\Users\Admin\AppData\Local\Temp\2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
"C:\Users\Admin\AppData\Local\Temp\2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe
      xlodersbekinglooka.sfx.exe -pxlodersbekinglooka.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:64
    - - C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bat.bat

Filesize
71B

MD5
d5cf377004f27f65558c383447d541f0

SHA1
3b413e653c0241256910982c79671e386dc81d28

SHA256
b87bf7396cb151b064a0ca8169dbe925d8afebd5878e5f5495a043f1f44f2243

SHA512
9dd1ed91cbf02c48fa7c5821d995dac8b71eab7afc9597a074277f1140ccdda5e86f5680914b2c8d5bfa97d3745f3135d0f8c8cafc11ab2355f3f7ae9dd4fce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbs.vbs

Filesize
89B

MD5
dc06d3c7415f4f6b05272426a63e9fd1

SHA1
2a148ec726cde2a19222c03ebf2cf48e8a5c171f

SHA256
101467d0422de2fafce3dc4e7f28343f7eab7f132a42843a9498b0fe3ffa9093

SHA512
d2063eddd861715db497adaf3440fc120aed019aa309ca2010d7b19e26987648c67f590e141df31b7c660cfebb33f052861fa2d1db5017e5f97dd4437155f76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe

Filesize
501KB

MD5
7828d59e8aad70882bb3950cb4a0f27d

SHA1
2aa02d7b66cb342794b74e056ba960f9181dfb47

SHA256
cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35

SHA512
1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe

Filesize
501KB

MD5
7828d59e8aad70882bb3950cb4a0f27d

SHA1
2aa02d7b66cb342794b74e056ba960f9181dfb47

SHA256
cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35

SHA512
1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe

Filesize
568KB

MD5
f674d0b20b39dcb63eb0c9b576dfa3c0

SHA1
03b1d9ecff1124d0ff499148ed36ee51e3eed4c2

SHA256
698e7886f9babb58f2093bdf232652feeb1db319f9235ce5ce096d818cb13652

SHA512
92db404340b169c24a81db4e74b99a87d0471e1623d49d84ef1dc4323fc9fcc440fbe671d1a9cc9af1e0ea81117f2c08912b2b6ed0543b5b8b1ae50f99fb843e

Download Submit
C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe

Filesize
568KB

MD5
f674d0b20b39dcb63eb0c9b576dfa3c0

SHA1
03b1d9ecff1124d0ff499148ed36ee51e3eed4c2

SHA256
698e7886f9babb58f2093bdf232652feeb1db319f9235ce5ce096d818cb13652

SHA512
92db404340b169c24a81db4e74b99a87d0471e1623d49d84ef1dc4323fc9fcc440fbe671d1a9cc9af1e0ea81117f2c08912b2b6ed0543b5b8b1ae50f99fb843e

Download Submit

Analysis

Sharing