shurk | 2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346

General

Target
2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
Size 732KB
Sample220328-sqzh8abdf8
SHA256 2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346
MD5 fb79729e325c9615648e2298ad535bc8
SHA1 29e07592fd1a162d8bc77078930c761e4da61a7e
SHA512 74b9a601076e54f58eea5d4d87d1a2e4246ead09e26d5c0574e9f03def030266474c2ac11013d666ddbf30559b49bee6ddc7b9067fd13c945dd3ff97a7544349
MD5 SHA1 SHA512

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000500000002062a-143.dat	shurk_stealer
behavioral2/files/0x000500000002062a-142.dat	shurk_stealer

Executes dropped EXE 2 IoCs

pid	Process
64	xlodersbekinglooka.sfx.exe
4264	xlodersbekinglooka.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation	xlodersbekinglooka.sfx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\00180008201401B1 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000002986c144e71db024f0eed4ffc35e015103c63e18539458202e31e826c0c2660f000000000e800000000200002000000099184dfa9b090666eda30af113a22bbe4840b6dd9ddf24f02b2c16025d830caf8000000007ead54a327b3474dfeb93e45a3e74c0354287e269282a1ee7f763450dbaa57104a192580a81b9f3586362fa6770e32008bfec24a7a7e91784618dc25143b349a8515de23bfd243cc4c2cf96285ecf3e3a8b1ec78915a506be9a2c9fec8e27a7d09514e4f5ebe3a0742e692b2c47bf9f16e5d8706894e398db960f93547fb14040000000cc3afc6e6e516817ed3cdc28f93ad4e98f45d1f40a0aff15e790f4b08bb3a81b10c2c3111317a1cd66552a7cf22b1cb2408e4274dc5cc4dd5cb8f3b88970f8be	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e000000000200000000001066000000010000200000000266db778e68e6a81f1b95492390407452467318541ce739aaec8ab0175d3aae000000000e800000000200002000000064d3576025a7c342cbfc1630757e1940d969366ab9a88972b97df0e5aadd7869100d00007ed706f56e3ef34c566b1bd533f09fbc878fe1a83313282214fb4aa1fad83df2e51697c15c85b4e0aff5ba0abc89b1509fa286e112e6d21f909ece478731e9a5549f570551f5b719b72b47983714ba1a1745cf9c3457de76ce2bf25041ce34fcc0d05e3f6c326d7fe8930aa2cfa6a2caad88ff79e5e2cb2e741008db8654be26ae60aa1878a80e870163ac1e48497ef924c4f867214428402dbac2be4d3a8d8cb93e3bce16f662d8c1dd9eb3dcc71e9a3e5160f3ccd86aa3d27e8490dd6227572ca2cec87f0812fc8b51b1e971ac0f7576f63d494055c0e07ef257c7994bf73ea18c93ae127990ddbfde6514c71ecef7d86f33297d848984a3b1e971b21fd7c15f053fd2fd5841afe1c3c27bac8b28cb7b751856a62e3df92298dfc541a7c5d804757c0191d47bb44926e36af4793df456c6d8212ad8596bdd3b5ec6be9f15085d7cb9ea96614009f11967fd992c02dbf6e23379dc954b09153079ecdc5a547a76324cf022a1a7be9f16a8d692e20cb6cdadc443c9dfb5540eaf3785108aafd0b58633707c36ba9f1cf899b2a227343d52527bd056cd4842335ae26a653437da4a93a2f1f8ec55944962e47f0b6d8f9c738a824778c14a03763cdf78aebfd5251d773e454d1b78a0fc6da0730a0bcd68755537f9ef165dabc7098250f0250eafe3b9f6eaf37ed069202a2a371aff0f63f8c5d36c0fc857d391962164ec8f6616ef8c8c9fabd91808bdc2447eb3019e72be9481d0af70c7369486642bceb5d45f3bd2ec383935739a9ffadcb390cd5b999d79fa471b68a5f18f3c5277ac09eafad64dcb1c440ccb5de7bea2565443e8abfb3f672bb31c73c708fa3bcfc7f27b31af3444925626327832ea7abb1d8c914aaaa86091426b962cfe93d87adf1de8a1b4575b3adeea7e1cc506fbe8462475b1c78b58efd4c2893d2569ce759b7c30a9a4ad93911a8614945266bfd0eb160ea4a32c5c42b754db7a4a52d269c854e2ce13749adbc6b78a5bf40b3dee38106a196e2f8d9f54460037233a034c45c2e588c6438c3ea1e6e8e7d84c8dfc54249b83fe6a1d73735957e0fd5e211bb980a4cddb24cea691e40344ae31b184516bc96b567a941b452e9e2d5db77a41fb84682d47c14da742a2f7126625e0045580fb02dd91ba672b8aff9623b9ff6285316587224438d53e6f4f7d6ca946e760b7aa2f9efad910aafe05d486cc36d3e2781e946e9b4bf458e71e6a5680b343dee877d668daa00c3e3891a28e3629b2a13c54bfeb19d8e5bf6e2cd70f110266c8404e12bc5d6067da808127b1572cee3ab8bdf14897bc8089fe0920e02c644de7e2b992f309ee7f468e15296c17089795fed494bdd9bba5eacae5341829dd69e9c7ce4cad08942d946d3f9530cba79c2d677b5112f14ad5ce0316e1ae4ec261fc01ab0bf4b079a2e0ea59fdf5fef73003e48a5c2cc332e0c7b3ef4bc3323db3bfa44a54bf0f5de71178bfb4be3b8db054f47a494441ebaef5d2007d9836215e9647d6fa8506e6cb2e1e15938c4437e95de93c7c03f82fca5c2955cd7ea5789a375ffcd3cae97618907ddb5a2795a9da242f8e22e5f8cb213ecc16aee9debd870469d3369b227d4f4f40925ef09d01654f95be4740c444aa1a6674a29d9862c31ef122bac0c86acc8e16edd1569f37f59156383e42ea21af6b4d72baee906b56b1cc9e61c0a47b0fe512633102857d5a678c0ad388c6c566af259988471a2d1b0ceae1d3f6f7cde338dde4ed372265f600892a7da10d1250b11c8154df695979a6020e84bbfac54939ecdb830d93e66832b31a0dea1efa5a5424e17a7c10a08c60f9a538874f2395bae8e63b374efba248b8c74fe396cbc61abcfab56cc94b35ac88dace48f533c919f07631ebb86a16f70279befaeb63f4ea770c2ec8c6428532f18a4a3208a5f5be2da0fafe1f6ed8cc769e9f88b33d8fbef9c4371b4384596939735fe8e6fd8bfcb99c2bc6c726bc8244b3a9f53c8ae500742a66cc2871a3fb85d13f693850a255440edda83e6cb168f48665faa4460100abbfcfabd32286ab2590f1ff8dc3db314d28bd74d3049b41aff7a110e813c87ea95c121819d08edcdd78e83293bc1c4462c341b7f246642496e51e92b6555f6d5328495b6a2b33b96840d569249b949c400017fdd5813982e5cfe9582c15bc57deb6f6cf2caec812e5363f663501adea2646d36d60c45f13b3aab251e18f13138b4a5bc1c8b5b0391cb0468de623412924bd28d810ce5ab9ac89b7a57e8883a46667dcd5106c6da4c2032ed88c543d2d5eac315fc696ba1ec8c4c351da3eb15ecb29d1fed9e362f3b067a94df810d1f6c30809bc94ce3a9541c8aee0508c15f19f925e6f0c580b1a9d9edba6801a4a73e3ebb7a8e1ea6b50b33146e290993f859595f8861ec71203c740af944f4cafb8e006ed5149b3673dec59239958bba1434aa73ad30f49d6184a3856656356a6e6ad09e8bbde92bf006de1db5c3f6f23af9fd67b35b0d2e3e3417b995bbab314a17d375094e454b379c979b4553aaa0f4f69a3622987fdc6a99577387ab838898129064c710b726f0b637c1be7667377a57e83815e5d7b3ef26e4f913e6bb9b4d8967e20807a6322652e2a436b6e4eaef52223baf0a217c4ac7acf280e49372a1656c0f478183561b30f89368abfacf7ec3bfa3b97bd69e69f3d2c854b0a6560e691b3e8082f93415b932ff46bef965a0897a50c78d547d8ae6b2f271269065c174c5a12739a4199f5e46ba410afa30984c2d7cb9864e631eae96ae649484c0334305213e7a10ccd45a8764c80508ea7f4567727ffbf29a9a26d2ca9a1c0ff135bbc0b14dda1bcda8c9b1a18bb62037ace2e3d9010393a47cbb2cd926fc9f0bdab8b1f81e6b5c1ba773ea83a3f6e6f9e319a7e9814ad6eb18bab7c22b8dd9fa19adc6a184dac78a78e1ce192042b72169b44ba9166f0870414d457208231359a7ffb5a17e841b808f3ad9a850db5776eb465264916facee549acca8fd39215e8c66b0060a8c42b8ceaaf27ccd5adea1b851f6d916fdc53406f2863089fc1a5891f8aa04b74b8cb8edefb68ac0db9bb8ad350c58c4b393f234cb320c1c01f9bd3167a1a7c02f195a92a80dfd0c709ee2870274560effcb4f6a320d1527c5c8d76bea83d180f5f41cb56466209b2df8e9d6f1370af8da12f6c2fd93e1da07554e50b9763aeccc134dea65a702711b4a9f183fe7b5fed8b500aeceae18454046cc89ce619ea2d82531f3f55bd91f51d2a5eb29a7b6f7520b71339b74c1ccd17a084c7cefd9541cc3360f6e47cb3deac92b98fe0983da375b7fa15de386bd49312dc2190c5aee81359f426b2f438d6bf1f72592ae704ee972474b9bec280fb6d5bbe54725dc0ed048051be227c57516d40c7e6d8d725011e5a428fab9ebdd18270c7a453e63614444492bf9de53545e4e1dd23771b69ab9c9f24374880fa1b0c0827c2327a872246edf3d282c1d586a6ea27c05f9ca23f178e581de086c897a9c41ca3a790e56d315425a023623abe8f00c9227c90c19dd2a52c1afdb75b13b32cc2abd9bb6f82083b12c91d9b1baec6157088d8527cf97ac45ab9b87ce53f5c5674cd9a81248e7b92461be47afc0df2946dae402965da76f9c4a3f696466f495563d2d952ffc01e1055c8c4e7a6d5def8a06984379c1cf466d2f7125d1bd84ce210552bc8667e142b20ce2f2684aaba1bee99ca6f5a754aaadecce65f1288fc581520464f6f545c25b57f0e787252c7b0353bb8b601086ddc667a8065138df75528b2b9fe13d7d75510213780cc8316d8756c9fb458c930f63169833bfa1769166ad28d3ce9838589808bf11b7e278df1c10851224068c46e30dd6c35e5c2c21f2f3ee80b6e9e4dd66eef8afe1c38892a88a95a0329f20497e732d11198b0477bc6d42af6863f6aa6a454505eab557ce491fafd3b7acd92120589d96af9f8c7d74ae73b77d74e47509c823f80ebc093f4ad3cabcad435c6a3d56dcb320282af1cb6156f73f7599afdd0da451e1967ecfcc6143f3b715c729f1aac4616340be9e0cc0850f2d66c974a37a7d53dd840dc83f01b598b09308af989ac464907e509d06a8b0c0ecf7bfb2924e49ce2fbee0cfb0813e5262475d56bd330c14df5cb9922ef3430e12dd9571732ea4897532369f36f3b08508563dd5bc8cc76e98657d19387971a0320d7c85416d7c007c462e2255841e2507dfae07792a0c46c66fc68d571b1a19dc0bcec399bb0b42b6a0a46af4e7badfc118ec12753832f81e4836c8ce9424bda256bc9ac9586ae95b45676beb1ec86f6f7bece7c5d1a17fc4eeebb24e034c287600a3ea3a94a689f1097f2cd922e47782cc5b803375f39f29b987175b980f28cf8d49dfbd0cd752ec72589723aa5f176933349bb337ecc01f365e54d8a230e25c4833290de4b2e3e52c7ee2e4e14e2d5c2775b1c85638d1a0de016c14b4269aa7154b9ec82fdd85106c7c65fd473dd84341fc0962444835f301624a44d374f440b3abd5d44e855df8c847c5d42a6ce29df5e26b7de7e33c610a926c8f1eaf44cca42a91a3ae5461cd8a247980d0c371a77d7b053d5474d8f3ba7a05309e318ec6fd06eb3e10171db75abe4f288250e4f20302d6a27e343c80df2521577019330096aa528b568f2334613317d2ef566ac91171bff5ec6bb211ae02f79ef72f7f68c15559d59495a4cbd5f1c5160c3d6e8105825ba87395c18ba40000000d96bfc01594332c0d2bd865ca03ea2398b73615b2e20d84b0cb9b3ab505811245aa662cd82234f28edfdb08e7f596929665370ae5525bcfafffe56bc9ad12680	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "00180008201401B1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\Local Settings	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4264	xlodersbekinglooka.exe
4264	xlodersbekinglooka.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3492 wrote to memory of 1092	3492	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	85
PID 3492 wrote to memory of 1092	3492	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	85
PID 3492 wrote to memory of 1092	3492	2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe	85
PID 1092 wrote to memory of 1480	1092	WScript.exe	86
PID 1092 wrote to memory of 1480	1092	WScript.exe	86
PID 1092 wrote to memory of 1480	1092	WScript.exe	86
PID 1480 wrote to memory of 64	1480	cmd.exe	88
PID 1480 wrote to memory of 64	1480	cmd.exe	88
PID 1480 wrote to memory of 64	1480	cmd.exe	88
PID 64 wrote to memory of 4264	64	xlodersbekinglooka.sfx.exe	89
PID 64 wrote to memory of 4264	64	xlodersbekinglooka.sfx.exe	89
PID 64 wrote to memory of 4264	64	xlodersbekinglooka.sfx.exe	89

C:\Users\Admin\AppData\Local\Temp\2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe
"C:\Users\Admin\AppData\Local\Temp\2279a2fc74c511633d4f497bb0b1411be114fbae287901e3f02139fd9c5d2346.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3492
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c bat.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe
      xlodersbekinglooka.sfx.exe -pxlodersbekinglooka.exe -dC:\Users\Admin\AppData\Local\Temp
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:64
    - - C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4264

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:4380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bat.bat

Path C:\Users\Admin\AppData\Local\Temp\bat.bat
Size 71B
SHA256 b87bf7396cb151b064a0ca8169dbe925d8afebd5878e5f5495a043f1f44f2243
MD5 d5cf377004f27f65558c383447d541f0
SHA1 3b413e653c0241256910982c79671e386dc81d28
SHA512 9dd1ed91cbf02c48fa7c5821d995dac8b71eab7afc9597a074277f1140ccdda5e86f5680914b2c8d5bfa97d3745f3135d0f8c8cafc11ab2355f3f7ae9dd4fce2
MD5 SHA1 SHA512

Submit Download

vbs.vbs

Path C:\Users\Admin\AppData\Local\Temp\vbs.vbs
Size 89B
SHA256 101467d0422de2fafce3dc4e7f28343f7eab7f132a42843a9498b0fe3ffa9093
MD5 dc06d3c7415f4f6b05272426a63e9fd1
SHA1 2a148ec726cde2a19222c03ebf2cf48e8a5c171f
SHA512 d2063eddd861715db497adaf3440fc120aed019aa309ca2010d7b19e26987648c67f590e141df31b7c660cfebb33f052861fa2d1db5017e5f97dd4437155f76a
MD5 SHA1 SHA512

Submit Download

xlodersbekinglooka.exe

Path C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe
Size 501KB
SHA256 cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35
MD5 7828d59e8aad70882bb3950cb4a0f27d
SHA1 2aa02d7b66cb342794b74e056ba960f9181dfb47
SHA512 1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd
MD5 SHA1 SHA512

Submit Download

xlodersbekinglooka.exe

Path C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.exe
Size 501KB
SHA256 cf0a4ce09745659cbd7cef000a963e17cd85d44705c1a517a87245f47e85ff35
MD5 7828d59e8aad70882bb3950cb4a0f27d
SHA1 2aa02d7b66cb342794b74e056ba960f9181dfb47
SHA512 1f31fca0a612b49d319c16acfdd3732a46229dcf46bb7f2d899092c8f2f1542f6a5d6e8e5f35cfbf2c4e15ec0243b72c2886f4196ff4bddec271227c463184cd
MD5 SHA1 SHA512

Submit Download

xlodersbekinglooka.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe
Size 568KB
SHA256 698e7886f9babb58f2093bdf232652feeb1db319f9235ce5ce096d818cb13652
MD5 f674d0b20b39dcb63eb0c9b576dfa3c0
SHA1 03b1d9ecff1124d0ff499148ed36ee51e3eed4c2
SHA512 92db404340b169c24a81db4e74b99a87d0471e1623d49d84ef1dc4323fc9fcc440fbe671d1a9cc9af1e0ea81117f2c08912b2b6ed0543b5b8b1ae50f99fb843e
MD5 SHA1 SHA512

Submit Download

xlodersbekinglooka.sfx.exe

Path C:\Users\Admin\AppData\Local\Temp\xlodersbekinglooka.sfx.exe
Size 568KB
SHA256 698e7886f9babb58f2093bdf232652feeb1db319f9235ce5ce096d818cb13652
MD5 f674d0b20b39dcb63eb0c9b576dfa3c0
SHA1 03b1d9ecff1124d0ff499148ed36ee51e3eed4c2
SHA512 92db404340b169c24a81db4e74b99a87d0471e1623d49d84ef1dc4323fc9fcc440fbe671d1a9cc9af1e0ea81117f2c08912b2b6ed0543b5b8b1ae50f99fb843e
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads