Analysis
- max time kernel
2s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
14/10/2023, 01:17
General
- Target t40bd50ace847a114b83265af91b7.exe
- Size 315KB
- Sample231014-bnd13ahd7v
- SHA256 7b2dea7a8eff410159459e3f89c5e4fa81f8b9d2f6ce02cfaf8e307f3adf9f85
Score
10/10
Malware Config
Extracted
Family
-
gurcu
C2
-
https://api.telegram.org/bot6237712604:AAESgAGfaQ0EUC8eWgMd7kpAW_FEGRDRfDs/sendMessage?chat_id=880824160
Signatures
- Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\t40bd50ace847a114b83265af91b7.exe"C:\Users\Admin\AppData\Local\Temp\t40bd50ace847a114b83265af91b7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3048-0-0x0000013B13640000-0x0000013B13694000-memory.dmp
memory/3048-1-0x00007FFB7BB30000-0x00007FFB7C5F1000-memory.dmp
memory/3048-2-0x0000013B15440000-0x0000013B15450000-memory.dmp