Overview

overview

10

Static

static

10

t536f0746f...1c.exe

windows7-x64

10

t536f0746f...1c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    6s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2023 02:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    t536f0746f287ffe6c9131c.exe

  • Size

    386KB

  • MD5

    e4d3a1d9c41d306200aa39ee9f718474

  • SHA1

    7af7cd1865189d69c94fdb28d38b090d322fb134

  • SHA256

    7e2371898d8c9121075812f5b9a57de66e7a11ac686042ac6bf59c07b2ad51a2

  • SHA512

    6fa7a52bedf77f2ff42d4042a6d4381003e63b38038062b89b7a69395db1dd2a44ac449036f901dabf2d1aaffef0e463d7c347f5c360bb72d2cc3f932358d186

  • SSDEEP

    6144:+2G9h7IouE6yrJTe4nPF9bCGV0fAaxYt:+th7d68e4P+GV0fApt

Score
10/10
gurcuspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\t536f0746f287ffe6c9131c.exe
    "C:\Users\Admin\AppData\Local\Temp\t536f0746f287ffe6c9131c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "t536f0746f287ffe6c9131c" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\t536f0746f287ffe6c9131c.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\t536f0746f287ffe6c9131c.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\t536f0746f287ffe6c9131c.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:584
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:656
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:1572
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "t536f0746f287ffe6c9131c" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\t536f0746f287ffe6c9131c.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:776
        • C:\Users\Admin\AppData\Local\TeamViewer\t536f0746f287ffe6c9131c.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\t536f0746f287ffe6c9131c.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1792

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\t536f0746f287ffe6c9131c.exe.log
      Filesize

      847B

      MD5

      3308a84a40841fab7dfec198b3c31af7

      SHA1

      4e7ab6336c0538be5dd7da529c0265b3b6523083

      SHA256

      169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

      SHA512

      97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

      Download Submit

    • C:\Users\Admin\AppData\Local\TeamViewer\t536f0746f287ffe6c9131c.exe
      Filesize

      386KB

      MD5

      e4d3a1d9c41d306200aa39ee9f718474

      SHA1

      7af7cd1865189d69c94fdb28d38b090d322fb134

      SHA256

      7e2371898d8c9121075812f5b9a57de66e7a11ac686042ac6bf59c07b2ad51a2

      SHA512

      6fa7a52bedf77f2ff42d4042a6d4381003e63b38038062b89b7a69395db1dd2a44ac449036f901dabf2d1aaffef0e463d7c347f5c360bb72d2cc3f932358d186

      Download Submit

    • C:\Users\Admin\AppData\Local\TeamViewer\t536f0746f287ffe6c9131c.exe
      Filesize

      386KB

      MD5

      e4d3a1d9c41d306200aa39ee9f718474

      SHA1

      7af7cd1865189d69c94fdb28d38b090d322fb134

      SHA256

      7e2371898d8c9121075812f5b9a57de66e7a11ac686042ac6bf59c07b2ad51a2

      SHA512

      6fa7a52bedf77f2ff42d4042a6d4381003e63b38038062b89b7a69395db1dd2a44ac449036f901dabf2d1aaffef0e463d7c347f5c360bb72d2cc3f932358d186

      Download Submit

    • memory/1748-0-0x0000027B5B2F0000-0x0000027B5B356000-memory.dmp

      Filesize

      408KB

      Download

    • memory/1748-3-0x00007FFEF8FF0000-0x00007FFEF9AB1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1748-4-0x0000027B759F0000-0x0000027B75A00000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1748-6-0x00007FFEF8FF0000-0x00007FFEF9AB1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1792-11-0x00007FFEF7B80000-0x00007FFEF8641000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1792-12-0x0000016A70770000-0x0000016A70780000-memory.dmp

      Filesize

      64KB

      Download