shurk | 9de0dfcf9baf669811374d2f6ed0a1182df8d0254cd210f6f2883c659014de5a

Resubmissions

11-07-2023 15:07

230711-shb3yshf25 10

11-07-2023 05:05

230711-fqw2waed46 10

Analysis

max time kernel
29s
max time network
33s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11-07-2023 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

7.0MB
MD5

7a7728a6ed63717026afc70d90780d54
SHA1

85861b46514cdb3fb55413af2f095455ff216747
SHA256

9de0dfcf9baf669811374d2f6ed0a1182df8d0254cd210f6f2883c659014de5a
SHA512

d9f877cf6e9f021069fd8e4d4623a944eb6bee34efa564cb64dfb3cdac9b756728c56e5b430e3f89606a49672917c503b19268d20594b95d3e15f1c244a39b43
SSDEEP

98304:ZLALpP1WbQ5/HChxfi0kMmJ6BxLk61BFO7FyAAC053zfVjOTHif:ZLA1SQ5/HSxfi0bBOubvCY8TC

Score

10^/10

shurk infostealer spyware stealer upx

Malware Config

Signatures

Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1824-54-0x0000000002B90000-0x0000000003401000-memory.dmp	shurk_stealer
behavioral1/memory/1824-65-0x0000000002B90000-0x0000000003401000-memory.dmp	shurk_stealer
behavioral1/memory/1824-66-0x0000000002B90000-0x0000000003401000-memory.dmp	shurk_stealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1824-54-0x0000000002B90000-0x0000000003401000-memory.dmp	upx
behavioral1/memory/1824-65-0x0000000002B90000-0x0000000003401000-memory.dmp	upx
behavioral1/memory/1824-66-0x0000000002B90000-0x0000000003401000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 checkip.amazonaws.com
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

WMIC.exe

pid process

324 WMIC.exe
GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 2 Go-http-client/1.1
HTTP User-Agent header 4 Go-http-client/1.1
HTTP User-Agent header 5 Go-http-client/1.1

flow	ioc
1	checkip.amazonaws.com

pid	process
324	WMIC.exe

description	flow	ioc
HTTP User-Agent header	2	Go-http-client/1.1
HTTP User-Agent header	4	Go-http-client/1.1
HTTP User-Agent header	5	Go-http-client/1.1

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

WMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	324	WMIC.exe
Token: SeSecurityPrivilege	324	WMIC.exe
Token: SeTakeOwnershipPrivilege	324	WMIC.exe
Token: SeLoadDriverPrivilege	324	WMIC.exe
Token: SeSystemProfilePrivilege	324	WMIC.exe
Token: SeSystemtimePrivilege	324	WMIC.exe
Token: SeProfSingleProcessPrivilege	324	WMIC.exe
Token: SeIncBasePriorityPrivilege	324	WMIC.exe
Token: SeCreatePagefilePrivilege	324	WMIC.exe
Token: SeBackupPrivilege	324	WMIC.exe
Token: SeRestorePrivilege	324	WMIC.exe
Token: SeShutdownPrivilege	324	WMIC.exe
Token: SeDebugPrivilege	324	WMIC.exe
Token: SeSystemEnvironmentPrivilege	324	WMIC.exe
Token: SeRemoteShutdownPrivilege	324	WMIC.exe
Token: SeUndockPrivilege	324	WMIC.exe
Token: SeManageVolumePrivilege	324	WMIC.exe
Token: 33	324	WMIC.exe
Token: 34	324	WMIC.exe
Token: 35	324	WMIC.exe
Token: SeIncreaseQuotaPrivilege	324	WMIC.exe
Token: SeSecurityPrivilege	324	WMIC.exe
Token: SeTakeOwnershipPrivilege	324	WMIC.exe
Token: SeLoadDriverPrivilege	324	WMIC.exe
Token: SeSystemProfilePrivilege	324	WMIC.exe
Token: SeSystemtimePrivilege	324	WMIC.exe
Token: SeProfSingleProcessPrivilege	324	WMIC.exe
Token: SeIncBasePriorityPrivilege	324	WMIC.exe
Token: SeCreatePagefilePrivilege	324	WMIC.exe
Token: SeBackupPrivilege	324	WMIC.exe
Token: SeRestorePrivilege	324	WMIC.exe
Token: SeShutdownPrivilege	324	WMIC.exe
Token: SeDebugPrivilege	324	WMIC.exe
Token: SeSystemEnvironmentPrivilege	324	WMIC.exe
Token: SeRemoteShutdownPrivilege	324	WMIC.exe
Token: SeUndockPrivilege	324	WMIC.exe
Token: SeManageVolumePrivilege	324	WMIC.exe
Token: 33	324	WMIC.exe
Token: 34	324	WMIC.exe
Token: 35	324	WMIC.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Setup.execmd.exe

description	pid	process	target process
PID 1824 wrote to memory of 3020	1824	Setup.exe	cmd.exe
PID 1824 wrote to memory of 3020	1824	Setup.exe	cmd.exe
PID 1824 wrote to memory of 3020	1824	Setup.exe	cmd.exe
PID 3020 wrote to memory of 324	3020	cmd.exe	WMIC.exe
PID 3020 wrote to memory of 324	3020	cmd.exe	WMIC.exe
PID 3020 wrote to memory of 324	3020	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\system32\cmd.exe
cmd /C "wmic path win32_VideoController get name"
2⤵
- Suspicious use of WriteProcessMemory
PID:3020

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:324

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1824-54-0x0000000002B90000-0x0000000003401000-memory.dmp

Filesize
8.4MB

Download
memory/1824-64-0x00000000024C0000-0x0000000002B8A000-memory.dmp

Filesize
6.8MB

Download
memory/1824-65-0x0000000002B90000-0x0000000003401000-memory.dmp

Filesize
8.4MB

Download
memory/1824-66-0x0000000002B90000-0x0000000003401000-memory.dmp

Filesize
8.4MB

Download