gurcu | 41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4

Analysis

max time kernel
154s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2023 11:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
Size

289KB
MD5

88cfc2ccc0575567122d1d233f9eb1c3
SHA1

4be67d0d801197f88c14d62f4495f17e89fc471f
SHA256

41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4
SHA512

a2dd9ab7a2fe2a6d596c78394f65956f3e8973940229b305e2d763be69ff9f27b1450b5e08ca57cd0886a873fb663daad20ca94d9262a6c80a582dfc5f2e42b7
SSDEEP

6144:uHClm6SWPoK5Z0EwVSmRPQp+L5v9bbSUpi:uHCnZxb8hLLSUpi

Score

10^/10

gurcu collection discovery spyware stealer

Malware Config

Extracted

Family

gurcu

https://api.telegram.org/bot6176004110:AAFKA5be4dMwA848HWxzYIzrzzOGIHMOJGc/sendMessage?chat_id=615133582

Signatures

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Control Panel\International\Geo\Nation	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

Executes dropped EXE 2 IoCs

pid	Process
1132	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
4028	tor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
Key opened	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
Key opened	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
79	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1640	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3964	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1132	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
Token: SeDebugPrivilege	1132	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 4344	764	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe	85
PID 764 wrote to memory of 4344	764	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe	85
PID 4344 wrote to memory of 2176	4344	cmd.exe	87
PID 4344 wrote to memory of 2176	4344	cmd.exe	87
PID 4344 wrote to memory of 3964	4344	cmd.exe	88
PID 4344 wrote to memory of 3964	4344	cmd.exe	88
PID 4344 wrote to memory of 1640	4344	cmd.exe	94
PID 4344 wrote to memory of 1640	4344	cmd.exe	94
PID 4344 wrote to memory of 1132	4344	cmd.exe	95
PID 4344 wrote to memory of 1132	4344	cmd.exe	95
PID 1132 wrote to memory of 2152	1132	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe	98
PID 1132 wrote to memory of 2152	1132	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe	98
PID 1132 wrote to memory of 4028	1132	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe	101
PID 1132 wrote to memory of 4028	1132	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-528036852-1341495193-1175965888-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
"C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" &&START "" "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2176
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3964
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Xd2c386a3a6edfe99de10f6ce6b3659c4809a" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe" /rl HIGHEST /f
    3⤵
    - Creates scheduled task(s)
    PID:1640
- - C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe
    "C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:1132
  - - C:\Windows\System32\tar.exe
      "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmpBC1C.tmp" -C "C:\Users\Admin\AppData\Local\xdh16uwiax"
      4⤵
      PID:2152
  - - C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe
      "C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt"
      4⤵
      Executes dropped EXE
      PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe.log

Filesize
847B

MD5
3308a84a40841fab7dfec198b3c31af7

SHA1
4e7ab6336c0538be5dd7da529c0265b3b6523083

SHA256
169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

SHA512
97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

Download Submit
C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

Filesize
289KB

MD5
88cfc2ccc0575567122d1d233f9eb1c3

SHA1
4be67d0d801197f88c14d62f4495f17e89fc471f

SHA256
41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4

SHA512
a2dd9ab7a2fe2a6d596c78394f65956f3e8973940229b305e2d763be69ff9f27b1450b5e08ca57cd0886a873fb663daad20ca94d9262a6c80a582dfc5f2e42b7

Download Submit
C:\Users\Admin\AppData\Local\Nvidia\Xd2c386a3a6edfe99de10f6ce6b3659c4809a.exe

Filesize
289KB

MD5
88cfc2ccc0575567122d1d233f9eb1c3

SHA1
4be67d0d801197f88c14d62f4495f17e89fc471f

SHA256
41505242cdbf259aada52b773daeec33d239e4aefd685ba9e406d2cf2f9871a4

SHA512
a2dd9ab7a2fe2a6d596c78394f65956f3e8973940229b305e2d763be69ff9f27b1450b5e08ca57cd0886a873fb663daad20ca94d9262a6c80a582dfc5f2e42b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBC1C.tmp

Filesize
13.3MB

MD5
89d2d5811c1aff539bb355f15f3ddad0

SHA1
5bb3577c25b6d323d927200c48cd184a3e27c873

SHA256
b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

SHA512
39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

Download Submit
C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdesc-consensus.tmp

Filesize
2.7MB

MD5
0fce54e46096ee822ad8c573226cae3c

SHA1
347bf76e634675b677e9783b8b96f0b9cb511b1f

SHA256
85f2018ff17b3d4675ec2c4fccd8f3acf677ec0850c011c277d2c5e9f4fd8125

SHA512
cbe08200803c4c8d4137512c6b9c6421a7d1923fff1c2e7a5c2385e14ec8f70b298e6a1acf8b6ba492e57ee4f89315155269329686e598c5996a8d1bf9f306a5

Download Submit
C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdescs.new

Filesize
10.3MB

MD5
aa3ac70770a8a3628f9a274bbab99394

SHA1
c25f8beb8f94b69622a8a4ec90b2d004d00bbafd

SHA256
955ac29976c569ae994e8c814a530480468fd7361b237326b36db51c16b7f69c

SHA512
53688c7d1fdff1050535516ef4ea28f06a83573a0551d1a716da291d4f08e8982e03cebac1b45283cde0d2c448f90d60dd18bbdcff0b167fe070cbcea320cd44

Download Submit
C:\Users\Admin\AppData\Local\xdh16uwiax\data\cached-microdescs.new

Filesize
10.3MB

MD5
7c132c0e678ea071333039cf88e5a7d9

SHA1
5da5e2364549f0fa0e060d3d748e2f9206ca19d8

SHA256
4974624cf806b7e9e7531e0105543878c909a3c849276565bce2926737d3e447

SHA512
8abb2d9a6d6ec3b6e5b7f9e24aba750d3bdfaeb3fb8ec7b01b6fbcee5534607b166e980634a7c2d437bfa6dd04f572780de68c5d6672700b14e2e62818f1115a

Download Submit
C:\Users\Admin\AppData\Local\xdh16uwiax\host\hostname

Filesize
64B

MD5
4c442b3b7dd3e51ca0ed85002cf220b3

SHA1
8d224e007344e26ff474a43081fb717e46f35c91

SHA256
f06e829548d0160a93ba5909f9764a3b52073dc3048548dbffff1f0043406459

SHA512
a8bf269ae7adff401bf0b7e3adb7ff73539a789a07e823b476825b642947d6f98b62159d6f3ed2a2a30ebcfefe3aba5f272ef1515da8d8caf2ecca8043a614de

Download Submit
C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe

Filesize
7.4MB

MD5
88590909765350c0d70c6c34b1f31dd2

SHA1
129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

SHA256
46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

SHA512
a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

Download Submit
C:\Users\Admin\AppData\Local\xdh16uwiax\tor\tor.exe

Filesize
7.4MB

MD5
88590909765350c0d70c6c34b1f31dd2

SHA1
129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

SHA256
46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

SHA512
a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

Download Submit
C:\Users\Admin\AppData\Local\xdh16uwiax\torrc.txt

Filesize
218B

MD5
76981b42daf271f573b269a33d014c15

SHA1
0f97248f72eac235837ac81e3f6676b1265e8585

SHA256
86fc9b9707c85b9ea87cde1253d2d503f6fca10a081c3046e23ad616ec1daff5

SHA512
255c0d4929ca423e21173e07ad02dbb5ed5fe505e0fcc42b0e3c4e151b60a1de0e2953af3036029aee6bc8279073f9dd6f7012cbf3f52155eb6e60025032c30c

Download Submit
memory/764-0-0x0000017C500F0000-0x0000017C5013E000-memory.dmp

Filesize
312KB

Download
memory/764-6-0x00007FFE6D480000-0x00007FFE6DF41000-memory.dmp

Filesize
10.8MB

Download
memory/764-2-0x0000017C50590000-0x0000017C505A0000-memory.dmp

Filesize
64KB

Download
memory/764-1-0x00007FFE6D480000-0x00007FFE6DF41000-memory.dmp

Filesize
10.8MB

Download
memory/1132-12-0x000001BCBEBF0000-0x000001BCBEC00000-memory.dmp

Filesize
64KB

Download
memory/1132-11-0x00007FFE6C350000-0x00007FFE6CE11000-memory.dmp

Filesize
10.8MB

Download
memory/1132-42-0x00007FFE6C350000-0x00007FFE6CE11000-memory.dmp

Filesize
10.8MB

Download
memory/1132-51-0x000001BCBEBF0000-0x000001BCBEC00000-memory.dmp

Filesize
64KB

Download