Overview

overview

10

Static

static

3

70928f0707...5c.exe

windows7-x64

10

70928f0707...5c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    11s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/09/2023, 16:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    70928f07076ca83678812570f1e9f05c.exe
  • Size 11.3MB
  • Sample230930-twc3vafb93
  • SHA256 4a20d88652a74ef776db2ace59a63815f3c446fb62f7d443145a97158ec19436
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
shurkinfostealerspywarestealer

Malware Config

Signatures

  • Shurk

    Shurk is an infostealer, written in C++ which appeared in 2021.

    infostealershurk
  • Shurk Stealer payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • GoLang User-Agent 2 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

Processes

  • C:\Users\Admin\AppData\Local\Temp\70928f07076ca83678812570f1e9f05c.exe
    "C:\Users\Admin\AppData\Local\Temp\70928f07076ca83678812570f1e9f05c.exe"
    1⤵
      PID:4912

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/4912-0-0x000002ACCC1C0000-0x000002ACCC972000-memory.dmp
          Download

          memory/4912-1-0x00007FF4E3F30000-0x00007FF4E474B000-memory.dmp
          Download