shurk | acca78436c3cd5a2a32e3a0b869a9332b64c31f5668d856bf54705f0f06533fc

Analysis

max time kernel
143s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 15:34

Target

acca78436c3cd5a2a32e3a0b869a9332b64c31f5668d856bf54705f0f06533fc.exe
Size

5.6MB
MD5

1c4cecba391dd5a29b873eb458893fe5
SHA1

c880c6f2f96bdf7f709abe627b6c8a8741cbfe35
SHA256

acca78436c3cd5a2a32e3a0b869a9332b64c31f5668d856bf54705f0f06533fc
SHA512

03320867b691d4b72833377ae0142487e53de57e1054fc32a783cfafd8eeba52e038923def649d52791cbfaee5941615c7d64e58ca392f2b9a4b2d926bbc1e6b
SSDEEP

98304:X/CGIiu2FPW5UooROfW4K9pPkzomki98rpujB+70sL37TfnrNa:X/CCtW5k4ePXi3jBNsb7TfrN

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1368-54-0x00000000009C0000-0x0000000001306000-memory.dmp	shurk_stealer
behavioral1/memory/1368-57-0x00000000009C0000-0x0000000001306000-memory.dmp	shurk_stealer
behavioral1/memory/1368-58-0x00000000009C0000-0x0000000001306000-memory.dmp	shurk_stealer

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1368-54-0x00000000009C0000-0x0000000001306000-memory.dmp	vmprotect
behavioral1/memory/1368-57-0x00000000009C0000-0x0000000001306000-memory.dmp	vmprotect
behavioral1/memory/1368-58-0x00000000009C0000-0x0000000001306000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	acca78436c3cd5a2a32e3a0b869a9332b64c31f5668d856bf54705f0f06533fc.exe
1368	acca78436c3cd5a2a32e3a0b869a9332b64c31f5668d856bf54705f0f06533fc.exe

C:\Users\Admin\AppData\Local\Temp\acca78436c3cd5a2a32e3a0b869a9332b64c31f5668d856bf54705f0f06533fc.exe
"C:\Users\Admin\AppData\Local\Temp\acca78436c3cd5a2a32e3a0b869a9332b64c31f5668d856bf54705f0f06533fc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1368-54-0x00000000009C0000-0x0000000001306000-memory.dmp

Filesize
9.3MB

Download
memory/1368-57-0x00000000009C0000-0x0000000001306000-memory.dmp

Filesize
9.3MB

Download
memory/1368-58-0x00000000009C0000-0x0000000001306000-memory.dmp

Filesize
9.3MB

Download