gurcu | 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3

Resubmissions

10/04/2024, 02:58

240410-dgn9kacd4610

10/04/2024, 02:58

10/04/2024, 02:58

10/04/2024, 02:58

23/08/2023, 14:58

Analysis

max time kernel
44s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
loader.exe
Size 401KB
Sample230823-sb7laaed41
SHA256 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
MD5 69e3cdc923b668aec4cb405c040565c6
SHA1 6a675ebf6f241e543f7bb50ccc8ead462a427880
SHA512 5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
SSDEEP 6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gurcu spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Executes dropped EXE 3 IoCs

pid	Process
1544	loader.exe
2044	tor.exe
548	loader.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
135	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3296	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1852	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	loader.exe
1544	loader.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4960	loader.exe
Token: SeDebugPrivilege	1544	loader.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1544	loader.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4508	4960	loader.exe	80
PID 4960 wrote to memory of 4508	4960	loader.exe	80
PID 4508 wrote to memory of 4548	4508	cmd.exe	82
PID 4508 wrote to memory of 4548	4508	cmd.exe	82
PID 4508 wrote to memory of 1852	4508	cmd.exe	83
PID 4508 wrote to memory of 1852	4508	cmd.exe	83
PID 4508 wrote to memory of 3296	4508	cmd.exe	84
PID 4508 wrote to memory of 3296	4508	cmd.exe	84
PID 4508 wrote to memory of 1544	4508	cmd.exe	85
PID 4508 wrote to memory of 1544	4508	cmd.exe	85
PID 1544 wrote to memory of 2104	1544	loader.exe	89
PID 1544 wrote to memory of 2104	1544	loader.exe	89
PID 1544 wrote to memory of 2044	1544	loader.exe	93
PID 1544 wrote to memory of 2044	1544	loader.exe	93

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\loader.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4508
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4548
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1852
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "loader" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:3296
- - C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
    "C:\Users\Admin\AppData\Local\TeamViewer\loader.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp" -C "C:\Users\Admin\AppData\Local\jjmzzxbvaf"
      4⤵
      PID:2104
  - - C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
      "C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt"
      4⤵
      Executes dropped EXE
      PID:2044

C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
1⤵
- Executes dropped EXE
PID:548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

loader.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\loader.exe.log
Size 847B
SHA256 169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e
MD5 3308a84a40841fab7dfec198b3c31af7
SHA1 4e7ab6336c0538be5dd7da529c0265b3b6523083
SHA512 97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198
MD5 SHA1 SHA512

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
Size 401KB
SHA256 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
MD5 69e3cdc923b668aec4cb405c040565c6
SHA1 6a675ebf6f241e543f7bb50ccc8ead462a427880
SHA512 5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
SSDEEP 6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
Size 401KB
SHA256 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
MD5 69e3cdc923b668aec4cb405c040565c6
SHA1 6a675ebf6f241e543f7bb50ccc8ead462a427880
SHA512 5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
SSDEEP 6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

loader.exe

Path C:\Users\Admin\AppData\Local\TeamViewer\loader.exe
Size 401KB
SHA256 8d647fd3ebb00c9d853eb728ff7cba75b7a089d30f84090e3bc1dc460bdd47f3
MD5 69e3cdc923b668aec4cb405c040565c6
SHA1 6a675ebf6f241e543f7bb50ccc8ead462a427880
SHA512 5580919f6710fc210f079875eae22a87c85e854b57f59d10fc22680460f370154d7d223a66c9797387e4675a7954ba6f051a34571499481927980eb9ebf07cdb
SSDEEP 6144:+CGmWI/2hvRn6Ie646G0D1eBlxy9bAmI6:+KWI/8B6Q9b5eBlxnmI6
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpC94B.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp
Size 13.3MB
SHA256 b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
MD5 89d2d5811c1aff539bb355f15f3ddad0
SHA1 5bb3577c25b6d323d927200c48cd184a3e27c873
SHA512 39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289
SSDEEP 393216:2YEKAkOvd2hKJDrq/OtTCRMTJqIdLZOBgfZn:XEJP2cJD2+GOJqMZOBGZn
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdesc-consensus.tmp
Size 2.5MB
SHA256 6b47307d184ff963a8b4e152a29f13fe6642e0f31115f97c23837f8cd0820279
MD5 8b729d2f0958337cf9c78b1d904fe24f
SHA1 542982f4376104c1b0e943eea9a293df3ea3e756
SHA512 127593501f6146406bd2db99293289c1d2d3012c0410428fb8f4c4bfdb4c92d38b83b237c7dc470be8bf8af0a2faccc73a3d16966b4c21612f57dd6597452bde
SSDEEP 12288:pWV5AK/+XqHy4aE8d7eHQYu++6x+S3XqCq8O4Vw31CPILj0iiqfuz:YbApaEEe8GYqCntw3A4iR
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\data\cached-microdescs.new
Size 5.0MB
SHA256 6b1640b96711ac7001f9b3320d853617e6ece61d2c223d5184941c9949ab12c3
MD5 c6e4cbe90c0c17c1b6593c81d5967276
SHA1 99839b72d325b681e20d3c794725c4c02f46a282
SHA512 fd78d036d65cb7cb35f98b79912a1ae898a5e40f0c72906144c29ff29bdf00232c52e28c856dac9cf81fef5ffc18b305c5481bab516bd195fe26ab162eb67b6a
SSDEEP 24576:ddr9SjxLc42y987QM6WbI3VB17SFLDOmJpfTOnUywgYege0stAPpRxu/4MkDzN2W:TRF4lbq1bT1wAl
MD5 SHA1 SHA512 SSDEEP

Submit Download

hostname

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\host\hostname
Size 64B
SHA256 0a46a7e601c5b1eec022735e027916706f9185a0a3dc453ff170bc0a7e455bfc
MD5 f109138dccb9ab5ab96ba6cb471cc2e5
SHA1 4848821515adcfee4db59a7b6c4f3673d7a5b6e6
SHA512 a70c4c9d67f5c839bdf7075a25978785fcd278bb0f9d1712c0dd5e1ef6c338e582cb2a24e3e744d036529128a5d90884e036dc20304c00830790fec0ce9d3f56
MD5 SHA1 SHA512

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
Size 7.4MB
SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
MD5 88590909765350c0d70c6c34b1f31dd2
SHA1 129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7
SHA512 a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192
SSDEEP 98304:3iPgwPv8LqpP5ZkfiSMdm+KHMU2O1R0fzwkEOlcHA6IZGQ:VbM8jjX1R0R6YL
MD5 SHA1 SHA512 SSDEEP

Submit Download

tor.exe

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\tor\tor.exe
Size 7.4MB
SHA256 46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
MD5 88590909765350c0d70c6c34b1f31dd2
SHA1 129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7
SHA512 a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192
SSDEEP 98304:3iPgwPv8LqpP5ZkfiSMdm+KHMU2O1R0fzwkEOlcHA6IZGQ:VbM8jjX1R0R6YL
MD5 SHA1 SHA512 SSDEEP

Submit Download

torrc.txt

Path C:\Users\Admin\AppData\Local\jjmzzxbvaf\torrc.txt
Size 218B
SHA256 5c12fe24ec3e3ce1edac0cc1744ca5de4d71a8162f8549c12dfa5fc06ca20e53
MD5 acaa01da6c89329732060da0c18be350
SHA1 9ad32a4b0a75e5cadb85318df5f0e49ca6ac2bf9
SHA512 e005a2320e5c0bdc3be4a57a205a15a3ac74e451e05586f4446b9028b5743c1d8ebbaf6ef7ac8793d3c702f5a5cb0a01a6181e7e202633fd600a78e88419d833
MD5 SHA1 SHA512

Submit Download

memory/548-76-0x00007FFEF4B20000-0x00007FFEF55E1000-memory.dmp

Download

memory/1544-12-0x000002C3A9420000-0x000002C3A9430000-memory.dmp

Download

memory/1544-11-0x00007FFEF4B20000-0x00007FFEF55E1000-memory.dmp

Download

memory/1544-40-0x00007FFEF4B20000-0x00007FFEF55E1000-memory.dmp

Download

memory/1544-41-0x000002C3A9420000-0x000002C3A9430000-memory.dmp

Download

memory/4960-0-0x0000026C084A0000-0x0000026C08508000-memory.dmp

Download

memory/4960-6-0x00007FFEF4B20000-0x00007FFEF55E1000-memory.dmp

Download

memory/4960-2-0x0000026C229B0000-0x0000026C229C0000-memory.dmp

Download

memory/4960-1-0x00007FFEF4B20000-0x00007FFEF55E1000-memory.dmp

Download