shurk | 5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078

Analysis

max time kernel
138s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 19:36

Target

5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe
Size

1.5MB
MD5

5999044feccc278e622163585a5a59a6
SHA1

3465acee64d050e0f565d96b9994ddf00482e9e2
SHA256

5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078
SHA512

8a7ad09a75e4557821e73f1fa1be210b9f9aff5413b906087df7e009cf6c37b1a2be15d9e8d6653ee8347591ce228b38fc74147e329861b11125870a531c02a8
SSDEEP

24576:EHxHxfEt7FTp8nQxNw6wyPF5FtQuEuyKL:axHxfElVgQf9/t/P7

Score

10^/10

shurk infostealer

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/1440-58-0x00000000004494F1-mapping.dmp	shurk_stealer
behavioral1/memory/1440-57-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer
behavioral1/memory/1440-60-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer
behavioral1/memory/1440-61-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1080 set thread context of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1440	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28
PID 1080 wrote to memory of 1440	1080	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	28

C:\Users\Admin\AppData\Local\Temp\5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe
"C:\Users\Admin\AppData\Local\Temp\5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440

memory/1080-54-0x0000000001060000-0x00000000011EE000-memory.dmp

Filesize
1.6MB

Download
memory/1080-55-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1080-56-0x0000000000970000-0x000000000098E000-memory.dmp

Filesize
120KB

Download
memory/1440-57-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1440-60-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1440-61-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download