shurk | 5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2023, 19:36

Target
5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe
Size 1.5MB
Sample230129-ya8d3sba96
SHA256 5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078
MD5 5999044feccc278e622163585a5a59a6
SHA1 3465acee64d050e0f565d96b9994ddf00482e9e2
SHA512 8a7ad09a75e4557821e73f1fa1be210b9f9aff5413b906087df7e009cf6c37b1a2be15d9e8d6653ee8347591ce228b38fc74147e329861b11125870a531c02a8
SSDEEP 24576:EHxHxfEt7FTp8nQxNw6wyPF5FtQuEuyKL:axHxfElVgQf9/t/P7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

shurk infostealer

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/1520-136-0x0000000000000000-mapping.dmp	shurk_stealer
behavioral2/memory/1520-137-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer
behavioral2/memory/1520-138-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer
behavioral2/memory/1520-139-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer
behavioral2/memory/1520-140-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer
behavioral2/memory/1520-141-0x0000000000400000-0x000000000047F000-memory.dmp	shurk_stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4736 set thread context of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1520	AddInProcess32.exe
1520	AddInProcess32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 956	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	81
PID 4736 wrote to memory of 956	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	81
PID 4736 wrote to memory of 956	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	81
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82
PID 4736 wrote to memory of 1520	4736	5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe	82

C:\Users\Admin\AppData\Local\Temp\5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe
"C:\Users\Admin\AppData\Local\Temp\5fb21e151a535d3df978971cdd13c68a0c29b3a9ead326fc0153f2a65f17a078.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1520

memory/1520-137-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1520-138-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1520-139-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1520-140-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/1520-141-0x0000000000400000-0x000000000047F000-memory.dmp

Download

memory/4736-132-0x0000000000050000-0x00000000001DE000-memory.dmp

Download

memory/4736-133-0x00000000075B0000-0x0000000007B54000-memory.dmp

Download

memory/4736-134-0x00000000070A0000-0x0000000007132000-memory.dmp

Download

memory/4736-135-0x0000000007060000-0x000000000706A000-memory.dmp

Download