gurcu | fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2023 22:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

build4.exe
Size

165KB
MD5

547933c1a8ea0eb111e619d70ca2c657
SHA1

aca394a095c3951ace115ac621a67df1ff4d2e33
SHA256

fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea
SHA512

5df1b41c5f19e304cc0758b175252c17cc6ccb1d3d91ba2f153138dfbd8e2ef3cd6efe8a136559c55952bdb43a7f206f7ba4e04674ee95363ca8409e48745c2b
SSDEEP

1536:ROwwIJbzij3pPEOGFmd8Szav8IDYFUxT1DR5jPVSBSVG41AG9wL4yXacCwPIC6Xi:RyIlz2p8Yai3GNzDeeb4FzeDGwKSHqj

Score

10^/10

gurcu spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	build4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	build4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	build4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	build4.exe

Executes dropped EXE 6 IoCs

pid	Process
1312	build4.exe
3776	tor.exe
1872	build4.exe
4028	tor.exe
2052	build4.exe
4168	tor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4416	1872	WerFault.exe	99
3296	2052	WerFault.exe	105

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1480	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4776	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1312	build4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1312	build4.exe
Token: SeDebugPrivilege	1872	build4.exe
Token: SeDebugPrivilege	2052	build4.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4240	5036	build4.exe	82
PID 5036 wrote to memory of 4240	5036	build4.exe	82
PID 4240 wrote to memory of 4272	4240	cmd.exe	84
PID 4240 wrote to memory of 4272	4240	cmd.exe	84
PID 4240 wrote to memory of 4776	4240	cmd.exe	85
PID 4240 wrote to memory of 4776	4240	cmd.exe	85
PID 4240 wrote to memory of 1480	4240	cmd.exe	86
PID 4240 wrote to memory of 1480	4240	cmd.exe	86
PID 4240 wrote to memory of 1312	4240	cmd.exe	87
PID 4240 wrote to memory of 1312	4240	cmd.exe	87
PID 1312 wrote to memory of 5092	1312	build4.exe	88
PID 1312 wrote to memory of 5092	1312	build4.exe	88
PID 1312 wrote to memory of 3776	1312	build4.exe	90
PID 1312 wrote to memory of 3776	1312	build4.exe	90
PID 1872 wrote to memory of 4028	1872	build4.exe	100
PID 1872 wrote to memory of 4028	1872	build4.exe	100
PID 2052 wrote to memory of 4168	2052	build4.exe	106
PID 2052 wrote to memory of 4168	2052	build4.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\build4.exe
"C:\Users\Admin\AppData\Local\Temp\build4.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "build4" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\NET.Framework\build4.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\build4.exe" &&START "" "C:\Users\Admin\AppData\Local\NET.Framework\build4.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4272
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:4776
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "build4" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\NET.Framework\build4.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1480
- - C:\Users\Admin\AppData\Local\NET.Framework\build4.exe
    "C:\Users\Admin\AppData\Local\NET.Framework\build4.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmpA0B9.tmp" -C "C:\Users\Admin\AppData\Local\d92pmiifqt"
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe
      "C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d92pmiifqt\torrc.txt"
      4⤵
      Executes dropped EXE
      PID:3776

C:\Users\Admin\AppData\Local\NET.Framework\build4.exe
C:\Users\Admin\AppData\Local\NET.Framework\build4.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe
  "C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d92pmiifqt\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1872 -s 1624
  2⤵
  - Program crash
  PID:4416

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 1872 -ip 1872
1⤵
PID:708

C:\Users\Admin\AppData\Local\NET.Framework\build4.exe
C:\Users\Admin\AppData\Local\NET.Framework\build4.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe
  "C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d92pmiifqt\torrc.txt"
  2⤵
  - Executes dropped EXE
  PID:4168
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2052 -s 1624
  2⤵
  - Program crash
  PID:3296

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 504 -p 2052 -ip 2052
1⤵
PID:4620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\build4.exe.log

Filesize
847B

MD5
3308a84a40841fab7dfec198b3c31af7

SHA1
4e7ab6336c0538be5dd7da529c0265b3b6523083

SHA256
169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

SHA512
97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

Download Submit
C:\Users\Admin\AppData\Local\NET.Framework\build4.exe

Filesize
165KB

MD5
547933c1a8ea0eb111e619d70ca2c657

SHA1
aca394a095c3951ace115ac621a67df1ff4d2e33

SHA256
fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea

SHA512
5df1b41c5f19e304cc0758b175252c17cc6ccb1d3d91ba2f153138dfbd8e2ef3cd6efe8a136559c55952bdb43a7f206f7ba4e04674ee95363ca8409e48745c2b

Download Submit
C:\Users\Admin\AppData\Local\NET.Framework\build4.exe

Filesize
165KB

MD5
547933c1a8ea0eb111e619d70ca2c657

SHA1
aca394a095c3951ace115ac621a67df1ff4d2e33

SHA256
fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea

SHA512
5df1b41c5f19e304cc0758b175252c17cc6ccb1d3d91ba2f153138dfbd8e2ef3cd6efe8a136559c55952bdb43a7f206f7ba4e04674ee95363ca8409e48745c2b

Download Submit
C:\Users\Admin\AppData\Local\NET.Framework\build4.exe

Filesize
165KB

MD5
547933c1a8ea0eb111e619d70ca2c657

SHA1
aca394a095c3951ace115ac621a67df1ff4d2e33

SHA256
fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea

SHA512
5df1b41c5f19e304cc0758b175252c17cc6ccb1d3d91ba2f153138dfbd8e2ef3cd6efe8a136559c55952bdb43a7f206f7ba4e04674ee95363ca8409e48745c2b

Download Submit
C:\Users\Admin\AppData\Local\NET.Framework\build4.exe

Filesize
165KB

MD5
547933c1a8ea0eb111e619d70ca2c657

SHA1
aca394a095c3951ace115ac621a67df1ff4d2e33

SHA256
fdc83f58a30b80240c5887c6646324600f3896421059b80caddacfdb196287ea

SHA512
5df1b41c5f19e304cc0758b175252c17cc6ccb1d3d91ba2f153138dfbd8e2ef3cd6efe8a136559c55952bdb43a7f206f7ba4e04674ee95363ca8409e48745c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA0B9.tmp

Filesize
13.3MB

MD5
89d2d5811c1aff539bb355f15f3ddad0

SHA1
5bb3577c25b6d323d927200c48cd184a3e27c873

SHA256
b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

SHA512
39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\data\cached-microdesc-consensus.tmp

Filesize
2.3MB

MD5
4420df5ac9bad5913e290ac053dbe1a6

SHA1
e7d3925d0bab3bda3f3b11e2ede219a4c55c1d6c

SHA256
76aedd97fda4e32b44e99930fd823cb70a49ba9ddf7fd40fcd4e2289ed6d8db1

SHA512
243f5b92e96b7245354e40c08ceb28eb4fad8921d157c86f81fbe8f625d15186b66f5b2f094eb312cac529582e277d223646b9c4ab7ddae0feea1f14d5552335

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\data\cached-microdescs.new

Filesize
6.9MB

MD5
70cd583440b15132a136bc43e018c89f

SHA1
27e3e3b19f65b5e6286756b65d0048e331f82256

SHA256
797c557d3c8836a7c62f42c3da8c2161b44dbe5ebed151b8e46d06855d07c2d1

SHA512
04bab8534aabe6fbdf17662616eec3d30a1529572d86a39f6bfb59db2bd94bafd3787bfb019cf29c56a6515aab20e3a87b44e3348505fc0fff512fc03494344f

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\host\hostname

Filesize
64B

MD5
c42807ad3a9807324393d2fd846dc8fb

SHA1
500601b06d52e30febcc276a23b47942ecacbde6

SHA256
98dca6108e96bb5a7a74feb7030a3bb94bc40be2b2df53bff988b56ba9fff9fc

SHA512
6f1bf6995da2c695f1370ce29b7f2248ec3a3edb2852547d1511589d589930755ddc6bc48cfacbf9c2fb83a2a8e1c7e70f8c7aa1bbf5a76e4c2bce8c42ea9057

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\port.dat

Filesize
4B

MD5
778609db5dc7e1a8315717a9cdd8fd6f

SHA1
a90159cc1a7228e57680670297b8c7b575b9db3f

SHA256
3343427bd8ac1cfc0f8e51fee0f21ad7db5432ac07ac382768f7668bfd1309c9

SHA512
4e1e5a3f6375e541a9b625fc74a7e90f7caf15929088d2d6ba717a69d4e66b028bf9583c3b471d1411fc15f9ee01964e0ac782991716055748115fa44c57bfb2

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe

Filesize
7.4MB

MD5
88590909765350c0d70c6c34b1f31dd2

SHA1
129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

SHA256
46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

SHA512
a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe

Filesize
7.4MB

MD5
88590909765350c0d70c6c34b1f31dd2

SHA1
129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

SHA256
46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

SHA512
a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe

Filesize
7.4MB

MD5
88590909765350c0d70c6c34b1f31dd2

SHA1
129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

SHA256
46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

SHA512
a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\tor\tor.exe

Filesize
7.4MB

MD5
88590909765350c0d70c6c34b1f31dd2

SHA1
129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

SHA256
46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

SHA512
a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

Download Submit
C:\Users\Admin\AppData\Local\d92pmiifqt\torrc.txt

Filesize
218B

MD5
7fa3bdd47b4b6379c6081d1a547b751d

SHA1
127d473d0c1e20f9bae4cb280efa1bd73eeb40cb

SHA256
c6152d5775bf8758ed9ea3f517bf81ce231257e06420da7aafd490db1bbe7826

SHA512
e956d1e918feff8698e8e7639dc76e5955b3ad8cdba0778f117d58b378be36d287aeeb45e441f42e40ca380958638a2d9f1179d114e82c6b5c692e10b1c68e17

Download Submit
memory/1312-170-0x000001CEEDFA0000-0x000001CEEDFB0000-memory.dmp

Filesize
64KB

Download
memory/1312-143-0x000001CEEDFA0000-0x000001CEEDFB0000-memory.dmp

Filesize
64KB

Download
memory/1872-209-0x00000265F72C0000-0x00000265F72D0000-memory.dmp

Filesize
64KB

Download
memory/2052-216-0x000002391B6E0000-0x000002391B6F0000-memory.dmp

Filesize
64KB

Download
memory/5036-133-0x0000023DA5F40000-0x0000023DA5F70000-memory.dmp

Filesize
192KB

Download
memory/5036-134-0x0000023DA7C50000-0x0000023DA7C60000-memory.dmp

Filesize
64KB

Download