Overview

overview

10

Static

static

10

SecuriteIn...15.exe

windows7-x64

10

SecuriteIn...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    64s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2023, 00:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe

  • Size

    599KB

  • MD5

    fdb8081ac26d8de3f7582b2616bcf3e8

  • SHA1

    c46856c1394a0b36f7826285db0d72ae494f15f0

  • SHA256

    2c2d57d1ea08595db9a8a6c1bf8dbe40fac57a9b784eff00c4095c72fce80e98

  • SHA512

    0fdaa8f7c6ce93026fa1ad2e18b0ad31cd0e77afc17763042e841b039a2a1130b4138f34a2d32d8e74bee347f26b40f36d224be8b7f4cd7c2f6917617ff60c98

  • SSDEEP

    6144:kH5XgP9i7Nss/t/a2zDGVPJXvnzZjDJHb571Kjn1929XDccH89bq3vcebsVDsu:8UkRatpvnzZjDv7oj19yTN3vi1

Score
10/10
gurcucollectionspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6237712604:AAESgAGfaQ0EUC8eWgMd7kpAW_FEGRDRfDs/sendMessage?chat_id=880824160

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 16 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe"
      2⤵
      • Deletes itself
      • Suspicious use of WriteProcessMemory
      PID:1316
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1640
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:688
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:1096
        • C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe
          "C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe"
          3⤵
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:980
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 980 -s 1780
            4⤵
            • Program crash
            PID:1332
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {7509C309-EFC9-43AC-A89B-B0C328B23491} S-1-5-21-3430344531-3702557399-3004411149-1000:WFSTZEPN\Admin:Interactive:[1]
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe
        2⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1588
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 1588 -s 2892
          3⤵
          • Program crash
          PID:1744

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416
            Filesize

            1KB

            MD5

            55540a230bdab55187a841cfe1aa1545

            SHA1

            363e4734f757bdeb89868efe94907774a327695e

            SHA256

            d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

            SHA512

            c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
            Filesize

            62KB

            MD5

            3ac860860707baaf32469fa7cc7c0192

            SHA1

            c33c2acdaba0e6fa41fd2f00f186804722477639

            SHA256

            d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

            SHA512

            d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
            Filesize

            230B

            MD5

            7003cbda0aa5f29cb169d689771ec88f

            SHA1

            4d2861cbf5134ef3d973b47258b5946fe5e151e8

            SHA256

            0582d704a732c9039693534a33466b4e66d16d5bde2a80e282325be1173e7ac6

            SHA512

            5efaac4fe0c794d31db5c1d8ebce85804c530afd66a0ee317e9347adec8e972ed1968ab17a18fd6c30ad073b3e7518178985ed7835dc83f9e024cceb4cec6caa

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            bca34c0f589f6c2228b51db3430b72c9

            SHA1

            30539ee23e310966a8b4bd2dd37f318322df3d5a

            SHA256

            bef8887cc25bd9fe3bfd079b37f246aed54663d57f70d2ecd3ed6081e127470a

            SHA512

            4f8742b74925e0cac84340e2b2224191deb17e073e70fea6a72e290897fe44a0b54823d93b57dc203cdd4bab12aa02123aee319728608ff52507193ea904a6fb

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            76bec139115ed65e17552e664b76c85c

            SHA1

            03fee76b254db2218ce23a51fcd0c3c8a21344ce

            SHA256

            c4abbf2cff2cd5c1d99bff5cd0556f7e904b99c65340da58d1bfe96f859e8b6b

            SHA512

            26559e66529d9005a1047b5fe0fb979dfabe213d703888ec1135ab677145bc4894f6068685a84ea3020783723aa8ebba41a26f78aa9bd0d09f0bdb78fbbb9803

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            7d06f26c174b0f80f045b9832cd8a35f

            SHA1

            2e9ee4083b1d32f27225a1580b722db8e94412c7

            SHA256

            d3d1611445130db6a9beae79c277a1cd2651aa167e13a528c0941b351041a4ba

            SHA512

            0177b51df22379d17df2591562fdfd90c922e0c242388626ab956b5ecc09bcfef4461ca97b7a683c2a106fb4b9b065623dc944971580afabac0b0bf72885bde8

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            89655925cc0f498b402af901878655b6

            SHA1

            7e1ea61ec72d6d97a9be2f411d0058df3a7c3254

            SHA256

            532c70ffa2d7c57e99f7a5c0a1f6704ce963e422dd32a9aa5e12a1f2dbe51c9b

            SHA512

            e9a0b885d5dd7494368d1a1ce820fcc09e2eb186a70badc9563eb0ba6c6331349e8a39848d01ce0e388d0ae441dc7884137ec839fe0932ddb9d6ea2bef1f6e2d

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            a32dc17ac8667b46b36205d23336df4d

            SHA1

            630dacfdcee9635162b875ac39cf82a5c8d0a3ef

            SHA256

            1b2dd73392106f411a9c0f14549a6444c1f89d257b770250875f1b6ec9b213e2

            SHA512

            a23d40ba13ba3e75f9f0c965fa0761ffe8bf34cae6bf46839010d7cfb1cc82c79a81e25dbf1f0decc2aba0f017c462d36d5cf63584cdf238d909f5d1d64b3986

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            344B

            MD5

            3e54dd1bb586689d8cd85738a03e2cbd

            SHA1

            a77e303dd25b66843dc2f3e241b7ca454f4dceed

            SHA256

            f12191d1bec335b2e6e8283edcfa2643840577a22c57c30e1e9a23c7f814540b

            SHA512

            739e7b1c6986795a483b5541b574f79cd403fe565761d40ef4941b14b566ac3b6bb60619c9ac098e80531d56c69f14d4a282acd3ea552cd3b1ce1fc554e2f26d

            Download Submit

          • C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe
            Filesize

            599KB

            MD5

            fdb8081ac26d8de3f7582b2616bcf3e8

            SHA1

            c46856c1394a0b36f7826285db0d72ae494f15f0

            SHA256

            2c2d57d1ea08595db9a8a6c1bf8dbe40fac57a9b784eff00c4095c72fce80e98

            SHA512

            0fdaa8f7c6ce93026fa1ad2e18b0ad31cd0e77afc17763042e841b039a2a1130b4138f34a2d32d8e74bee347f26b40f36d224be8b7f4cd7c2f6917617ff60c98

            Download Submit

          • C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe
            Filesize

            599KB

            MD5

            fdb8081ac26d8de3f7582b2616bcf3e8

            SHA1

            c46856c1394a0b36f7826285db0d72ae494f15f0

            SHA256

            2c2d57d1ea08595db9a8a6c1bf8dbe40fac57a9b784eff00c4095c72fce80e98

            SHA512

            0fdaa8f7c6ce93026fa1ad2e18b0ad31cd0e77afc17763042e841b039a2a1130b4138f34a2d32d8e74bee347f26b40f36d224be8b7f4cd7c2f6917617ff60c98

            Download Submit

          • C:\Users\Admin\AppData\Local\EsetSecurity\SecuriteInfo.com.Trojan.Mardom.IN.24.4653.16515.exe
            Filesize

            599KB

            MD5

            fdb8081ac26d8de3f7582b2616bcf3e8

            SHA1

            c46856c1394a0b36f7826285db0d72ae494f15f0

            SHA256

            2c2d57d1ea08595db9a8a6c1bf8dbe40fac57a9b784eff00c4095c72fce80e98

            SHA512

            0fdaa8f7c6ce93026fa1ad2e18b0ad31cd0e77afc17763042e841b039a2a1130b4138f34a2d32d8e74bee347f26b40f36d224be8b7f4cd7c2f6917617ff60c98

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Cab4E72.tmp
            Filesize

            61KB

            MD5

            fc4666cbca561e864e7fdf883a9e6661

            SHA1

            2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

            SHA256

            10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

            SHA512

            c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Cab4FCB.tmp
            Filesize

            62KB

            MD5

            3ac860860707baaf32469fa7cc7c0192

            SHA1

            c33c2acdaba0e6fa41fd2f00f186804722477639

            SHA256

            d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

            SHA512

            d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\Tar507C.tmp
            Filesize

            164KB

            MD5

            4ff65ad929cd9a367680e0e5b1c08166

            SHA1

            c0af0d4396bd1f15c45f39d3b849ba444233b3a2

            SHA256

            c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

            SHA512

            f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

            Download Submit

          • C:\Users\Admin\AppData\Local\x22nso3f7r\port.dat
            Filesize

            4B

            MD5

            04ad5632029cbfbed8e136e5f6f7ddfa

            SHA1

            507ccf1d683cee3ba79bbc61648f431badea4635

            SHA256

            2f5b70c621fdcb0de0dcc46e2e4ef63a57dbe7fe6a564c9de9d42cd51c0beaf1

            SHA512

            0605f262d4c1c3ef86691986ceb26c70d09a474d58b2a7c1debfceffcbb63359376ed06174ff9da2b6be036a274eedbea6f8c031b20f01149fdb33c9e6008682

            Download Submit

          • memory/980-63-0x000000001B290000-0x000000001B310000-memory.dmp

            Filesize

            512KB

            Download

          • memory/980-61-0x00000000013C0000-0x000000000145A000-memory.dmp

            Filesize

            616KB

            Download

          • memory/980-322-0x000000001B290000-0x000000001B310000-memory.dmp

            Filesize

            512KB

            Download

          • memory/1212-54-0x0000000000360000-0x00000000003FA000-memory.dmp

            Filesize

            616KB

            Download

          • memory/1212-55-0x000000001AA90000-0x000000001AB10000-memory.dmp

            Filesize

            512KB

            Download