Analysis
-
max time kernel
26s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
14-10-2023 10:49
General
-
Target
ib0905dda0f2c3e0ed1483d05a9f368aaf094.exe
-
Size
324KB
-
MD5
3a4b332f0b65e0590f1fc1f07a516a59
-
SHA1
0ec94ea9e4e09abf1de65568b8864d21598cbcae
-
SHA256
aaa5229f28d23d73480f06b29368808f6d23b7fdaa4c5946250084247cf2192c
-
SHA512
34214d32b15bdf4ec70cf56876f110bdd36cdcd7e520ad0b9dd8ddbd85515f2baedda269dede378f43293c29efab81aec4f95c851a127fbb406c36796c4361c7
-
SSDEEP
3072:QdrpN/JxLKd5hkMnSFw73WnRO5UrYKBxwK30MIQbkMl+IOc2MZhUeNMhlB+Fp7vM:5PsGI4pfoN32h6SKrbq9blQPffL
Score
10/10
Malware Config
Extracted
Family
gurcu
C2
https://api.telegram.org/bot6021370805:AAFbCSlFairNgnxSj8mC6Wtf7PW5yGyWmcE/sendMessage?chat_id=6254396725
Signatures
-
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ib0905dda0f2c3e0ed1483d05a9f368aaf094.exe"C:\Users\Admin\AppData\Local\Temp\ib0905dda0f2c3e0ed1483d05a9f368aaf094.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
-
Filesize
10.8MB
-
Filesize
64KB