Analysis
- max time kernel
36s - max time network
38s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
25/03/2024, 10:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Delux.exe
Resource
win7-20240215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Delux.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target Delux.exe
- Size 6.7MB
- Sample240325-mz3pcagf71
- SHA256 5aa334801bc8cbb237dce697204736b502a85b02311d43302e94fde3a2f6e53e
- MD5 1587b8a54af451c287c552e390c59e38
- SHA1 cf15f4049dfe563229bcd52ddb8f5704d4979cbc
- SHA512 63542f6419c53502850fdc7b9e31bc63e62cdd8fcf6ba9c83f62616be57fe33540a4b9f81871c8cdfaa32be1fc909d13df3afb007cdd2d3898c0992e49228187
- SSDEEP 98304:vN9yp1NaIWBD64GcZ+GqznA5Uz2sDwzKFpWS2r:vzQPbGqzAKzUzW2
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
- Shurk Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/2620-1-0x0000000000400000-0x0000000000C70000-memory.dmp shurk_stealer behavioral2/memory/2620-2-0x0000000000400000-0x0000000000C70000-memory.dmp shurk_stealer behavioral2/memory/2620-16-0x0000000000400000-0x0000000000C70000-memory.dmp shurk_stealer - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/2620-1-0x0000000000400000-0x0000000000C70000-memory.dmp upx behavioral2/memory/2620-2-0x0000000000400000-0x0000000000C70000-memory.dmp upx behavioral2/memory/2620-16-0x0000000000400000-0x0000000000C70000-memory.dmp upx - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 checkip.amazonaws.com - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1356 WMIC.exe - GoLang User-Agent 4 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 6 Go-http-client/1.1 HTTP User-Agent header 21 Go-http-client/1.1 HTTP User-Agent header 24 Go-http-client/1.1 HTTP User-Agent header 31 Go-http-client/1.1 - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1356 WMIC.exe Token: SeSecurityPrivilege 1356 WMIC.exe Token: SeTakeOwnershipPrivilege 1356 WMIC.exe Token: SeLoadDriverPrivilege 1356 WMIC.exe Token: SeSystemProfilePrivilege 1356 WMIC.exe Token: SeSystemtimePrivilege 1356 WMIC.exe Token: SeProfSingleProcessPrivilege 1356 WMIC.exe Token: SeIncBasePriorityPrivilege 1356 WMIC.exe Token: SeCreatePagefilePrivilege 1356 WMIC.exe Token: SeBackupPrivilege 1356 WMIC.exe Token: SeRestorePrivilege 1356 WMIC.exe Token: SeShutdownPrivilege 1356 WMIC.exe Token: SeDebugPrivilege 1356 WMIC.exe Token: SeSystemEnvironmentPrivilege 1356 WMIC.exe Token: SeRemoteShutdownPrivilege 1356 WMIC.exe Token: SeUndockPrivilege 1356 WMIC.exe Token: SeManageVolumePrivilege 1356 WMIC.exe Token: 33 1356 WMIC.exe Token: 34 1356 WMIC.exe Token: 35 1356 WMIC.exe Token: 36 1356 WMIC.exe Token: SeIncreaseQuotaPrivilege 1356 WMIC.exe Token: SeSecurityPrivilege 1356 WMIC.exe Token: SeTakeOwnershipPrivilege 1356 WMIC.exe Token: SeLoadDriverPrivilege 1356 WMIC.exe Token: SeSystemProfilePrivilege 1356 WMIC.exe Token: SeSystemtimePrivilege 1356 WMIC.exe Token: SeProfSingleProcessPrivilege 1356 WMIC.exe Token: SeIncBasePriorityPrivilege 1356 WMIC.exe Token: SeCreatePagefilePrivilege 1356 WMIC.exe Token: SeBackupPrivilege 1356 WMIC.exe Token: SeRestorePrivilege 1356 WMIC.exe Token: SeShutdownPrivilege 1356 WMIC.exe Token: SeDebugPrivilege 1356 WMIC.exe Token: SeSystemEnvironmentPrivilege 1356 WMIC.exe Token: SeRemoteShutdownPrivilege 1356 WMIC.exe Token: SeUndockPrivilege 1356 WMIC.exe Token: SeManageVolumePrivilege 1356 WMIC.exe Token: 33 1356 WMIC.exe Token: 34 1356 WMIC.exe Token: 35 1356 WMIC.exe Token: 36 1356 WMIC.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2620 wrote to memory of 3728 2620 Delux.exe 94 PID 2620 wrote to memory of 3728 2620 Delux.exe 94 PID 3728 wrote to memory of 1356 3728 cmd.exe 95 PID 3728 wrote to memory of 1356 3728 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Delux.exe"C:\Users\Admin\AppData\Local\Temp\Delux.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
PID:1356
-
-