Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29-01-2023 18:31
General
-
Target
3466737690a5204b110c67c3a6be935e347b21a112fafe0784950cfe907450fc.exe
-
Size
7.0MB
-
MD5
bfa692ee18e128450fd26efefbd4cef2
-
SHA1
7a29eff8584ef211223f2ddf971901dfd8960be0
-
SHA256
3466737690a5204b110c67c3a6be935e347b21a112fafe0784950cfe907450fc
-
SHA512
2740e8bb9df2cae6a73a02b2aacd66d40423c95738a79d92a9d86f437bb220c406bdab3ee4444316f76cf5b95e5921068b615520b3b09e903d53b569b245108b
-
SSDEEP
196608:OFQ4BExN3TxQGyl+a4hBAIyVXxsGVvZVfAv4ofw0mTf7X+dRgw:OFQ4ExlTxdyl+aCfsXrJZV+4J9OdCw
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 3 IoCs
-
Executes dropped EXE 2 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 5 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3466737690a5204b110c67c3a6be935e347b21a112fafe0784950cfe907450fc.exe"C:\Users\Admin\AppData\Local\Temp\3466737690a5204b110c67c3a6be935e347b21a112fafe0784950cfe907450fc.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Cyberpunk2077 Trainer by Zanzer (+19)[v1.12].exe"C:\Users\Admin\AppData\Roaming\Cyberpunk2077 Trainer by Zanzer (+19)[v1.12].exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Roaming\Cyberpunk2077 Trainer by Zanzer.exe"C:\Users\Admin\AppData\Roaming\Cyberpunk2077 Trainer by Zanzer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD58a95f62223e6e023061ccbfbf7da9ddd
SHA1d9dc768871b63ae1ae891e61ac305522962cfb44
SHA25670cca864b07833cb22f05791a985e994b6df8a7d822f704a09b6439642809173
SHA5121c178f8a03fb887cc68ca1058f71e30bf953134468840028a76e1a2532a86721cbd2267f0a87ece559026159c29648b63ba9c85ba00ceb1762b9465e0a99abbc
-
Filesize
5.7MB
MD59c71ce719407ea94cc5b5741c03f6d02
SHA1a09529f3e357278121041c75329fe5185c04754a
SHA256075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e
SHA512649cb9a559ecb7d865434f072a5ee3d450ca64cc05ee6a94c8331091f0cce5d84cac4bf07a64234b5272b68beb470a1df0d1e40336ba3269f7c1c3656c3040d7
-
Filesize
5.7MB
MD59c71ce719407ea94cc5b5741c03f6d02
SHA1a09529f3e357278121041c75329fe5185c04754a
SHA256075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e
SHA512649cb9a559ecb7d865434f072a5ee3d450ca64cc05ee6a94c8331091f0cce5d84cac4bf07a64234b5272b68beb470a1df0d1e40336ba3269f7c1c3656c3040d7
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
9.4MB
-
Filesize
4.1MB
-
Filesize
4.1MB
-
Filesize
72KB
-
Filesize
7.0MB
-
Filesize
40KB