Analysis
-
max time kernel
139s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
29-01-2023 18:31
General
-
Target
075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe
-
Size
5.7MB
-
MD5
9c71ce719407ea94cc5b5741c03f6d02
-
SHA1
a09529f3e357278121041c75329fe5185c04754a
-
SHA256
075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e
-
SHA512
649cb9a559ecb7d865434f072a5ee3d450ca64cc05ee6a94c8331091f0cce5d84cac4bf07a64234b5272b68beb470a1df0d1e40336ba3269f7c1c3656c3040d7
-
SSDEEP
98304:z2/EokcNnTTR1YiuH5G+0m/MGDtRYX6Yet5xHPoGAVIhbJScCYv+hJsiYrg6C4nX:yso7nTTFeh/MIrg6/vxvfAVI6Hsim/LX
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 2 IoCs
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe"C:\Users\Admin\AppData\Local\Temp\075a2340456e0912827ae012e4e41e0eb38fb0198ae0a72cfaeededb36aef81e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.4MB
-
Filesize
9.4MB