shurk | cd197cd5e1dfc36ee9b6c148fdf19ae215faa6c3707045909c41b3ac8d28e673

General

Target

90650bd59d65af3b3cc34b318b68dd9c.exe
Size

434KB
MD5

90650bd59d65af3b3cc34b318b68dd9c
SHA1

a4042d9bb65c98c6476f03f4bca45b568c3f0317
SHA256

cd197cd5e1dfc36ee9b6c148fdf19ae215faa6c3707045909c41b3ac8d28e673
SHA512

98120dc5907acd56d6f0948df1b1061d75f99aef21ac7120f66f904c59974758d75643fe507de4c605918810dd40527401deeb4434c3fdccce63f87320c464d2

Score

10^/10

shurk infostealer spyware stealer

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer Payload 3 IoCs

resource	yara_rule
behavioral1/files/0x000a000000003d4a-57.dat	shurk_stealer
behavioral1/files/0x000a000000003d4a-60.dat	shurk_stealer
behavioral1/files/0x000a000000003d4a-58.dat	shurk_stealer

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
1312	newq.exe

Loads dropped DLL 2 IoCs

pid	Process
1316	90650bd59d65af3b3cc34b318b68dd9c.exe
1316	90650bd59d65af3b3cc34b318b68dd9c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\C:\ProgramData\newq.exe.lock	newq.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe
1312	newq.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	90650bd59d65af3b3cc34b318b68dd9c.exe
Token: SeDebugPrivilege	1312	newq.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1312	1316	90650bd59d65af3b3cc34b318b68dd9c.exe	28
PID 1316 wrote to memory of 1312	1316	90650bd59d65af3b3cc34b318b68dd9c.exe	28
PID 1316 wrote to memory of 1312	1316	90650bd59d65af3b3cc34b318b68dd9c.exe	28

C:\Users\Admin\AppData\Local\Temp\90650bd59d65af3b3cc34b318b68dd9c.exe
"C:\Users\Admin\AppData\Local\Temp\90650bd59d65af3b3cc34b318b68dd9c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\ProgramData\newq.exe
  "C:\ProgramData\newq.exe"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\newq.exe

Filesize
7.4MB

MD5
f543e8be3bdb1500f4c1fec95e8adc65

SHA1
c6814f27d0a89ac4fd3afd859fb0c8eb329ef12d

SHA256
834515f39e92aebf57fa605e96cbe5348801c53fa355caee2565b4ea2fbb6d97

SHA512
7c6575b79e69d17ab61aaf9cae23bc5ce0e7eabc30d0279ab8eee92de9d79893c29987f8519ac83c739410ec2ab89f5d2658582cb119b599fb0cd9be8300085a

Download Submit
\ProgramData\newq.exe

Filesize
7.4MB

MD5
f543e8be3bdb1500f4c1fec95e8adc65

SHA1
c6814f27d0a89ac4fd3afd859fb0c8eb329ef12d

SHA256
834515f39e92aebf57fa605e96cbe5348801c53fa355caee2565b4ea2fbb6d97

SHA512
7c6575b79e69d17ab61aaf9cae23bc5ce0e7eabc30d0279ab8eee92de9d79893c29987f8519ac83c739410ec2ab89f5d2658582cb119b599fb0cd9be8300085a

Download Submit
\ProgramData\newq.exe

Filesize
7.4MB

MD5
f543e8be3bdb1500f4c1fec95e8adc65

SHA1
c6814f27d0a89ac4fd3afd859fb0c8eb329ef12d

SHA256
834515f39e92aebf57fa605e96cbe5348801c53fa355caee2565b4ea2fbb6d97

SHA512
7c6575b79e69d17ab61aaf9cae23bc5ce0e7eabc30d0279ab8eee92de9d79893c29987f8519ac83c739410ec2ab89f5d2658582cb119b599fb0cd9be8300085a

Download Submit
memory/1316-54-0x0000000001010000-0x0000000001082000-memory.dmp

Filesize
456KB

Download
memory/1316-55-0x0000000000240000-0x00000000002E4000-memory.dmp

Filesize
656KB

Download
memory/1316-56-0x000000001B0E0000-0x000000001B0E2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing