shurk | 075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 18:31

Target

075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe
Size

5.7MB
MD5

9c71ce719407ea94cc5b5741c03f6d02
SHA1

a09529f3e357278121041c75329fe5185c04754a
SHA256

075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e
SHA512

649cb9a559ecb7d865434f072a5ee3d450ca64cc05ee6a94c8331091f0cce5d84cac4bf07a64234b5272b68beb470a1df0d1e40336ba3269f7c1c3656c3040d7
SSDEEP

98304:z2/EokcNnTTR1YiuH5G+0m/MGDtRYX6Yet5xHPoGAVIhbJScCYv+hJsiYrg6C4nX:yso7nTTFeh/MIrg6/vxvfAVI6Hsim/LX

Score

10^/10

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/1360-54-0x00000000008A0000-0x00000000011FB000-memory.dmp	shurk_stealer
behavioral1/memory/1360-57-0x00000000008A0000-0x00000000011FB000-memory.dmp	shurk_stealer
behavioral1/memory/1360-58-0x00000000008A0000-0x00000000011FB000-memory.dmp	shurk_stealer

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1360-54-0x00000000008A0000-0x00000000011FB000-memory.dmp	vmprotect
behavioral1/memory/1360-57-0x00000000008A0000-0x00000000011FB000-memory.dmp	vmprotect
behavioral1/memory/1360-58-0x00000000008A0000-0x00000000011FB000-memory.dmp	vmprotect

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1360	075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe
1360	075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe

C:\Users\Admin\AppData\Local\Temp\075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe
"C:\Users\Admin\AppData\Local\Temp\075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1360

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/1360-54-0x00000000008A0000-0x00000000011FB000-memory.dmp

Filesize
9.4MB

Download
memory/1360-57-0x00000000008A0000-0x00000000011FB000-memory.dmp

Filesize
9.4MB

Download
memory/1360-58-0x00000000008A0000-0x00000000011FB000-memory.dmp

Filesize
9.4MB

Download