Resubmissions
10/04/2024, 02:41
240410-c6hmmsfd7z1010/04/2024, 02:41
240410-c6g14scb461010/04/2024, 02:41
240410-c6gqcacb451010/04/2024, 02:41
240410-c6f4tacb441014/10/2023, 01:33
231014-bysbfahh6s10Analysis
- max time kernel
1788s - max time network
1737s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
10/04/2024, 02:41
General
- Target x19a4f9f3d16fcc9779ba8ea79bf7.exe
- Size 392KB
- Sample240410-c6hmmsfd7z
- SHA256 c3439dd56bcf3921cdbfcbdff3f928d14ebd632b3411235657bf9f5452c1ab9d
Malware Config
Extracted
-
gurcu
-
https://api.telegram.org/bot6193093056:AAHzyNGUGS9aUG6CCx6ENLoXpCFLzEQywIQ/sendMessage?chat_id=1098292643
Signatures
- Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
- Executes dropped EXE 31 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\x19a4f9f3d16fcc9779ba8ea79bf7.exe"C:\Users\Admin\AppData\Local\Temp\x19a4f9f3d16fcc9779ba8ea79bf7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "x19a4f9f3d16fcc9779ba8ea79bf7" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\x19a4f9f3d16fcc9779ba8ea79bf7.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "x19a4f9f3d16fcc9779ba8ea79bf7" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe"C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
-
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exeC:\Users\Admin\AppData\Local\TeamViewer\x19a4f9f3d16fcc9779ba8ea79bf7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
x19a4f9f3d16fcc9779ba8ea79bf7.exe.log
x19a4f9f3d16fcc9779ba8ea79bf7.exe
memory/416-50-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/416-49-0x000001EB48E70000-0x000001EB48E80000-memory.dmp
memory/416-2-0x0000022F630A0000-0x0000022F630B0000-memory.dmp
memory/416-1-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/416-48-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/416-6-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/416-0-0x0000022F61480000-0x0000022F614E8000-memory.dmp
memory/1272-65-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1272-64-0x0000018124390000-0x00000181243A0000-memory.dmp
memory/1272-63-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1444-89-0x0000027176660000-0x0000027176670000-memory.dmp
memory/1444-88-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1444-90-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1484-53-0x0000016E70A10000-0x0000016E70A20000-memory.dmp
memory/1484-52-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1484-54-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1920-44-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1920-46-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/1920-45-0x00000221DDF10000-0x00000221DDF20000-memory.dmp
memory/2116-27-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2116-26-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2136-79-0x000002237A220000-0x000002237A230000-memory.dmp
memory/2136-78-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2136-80-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2160-40-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2160-41-0x000001F8DC8A0000-0x000001F8DC8B0000-memory.dmp
memory/2160-42-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2388-16-0x000001D6BD610000-0x000001D6BD620000-memory.dmp
memory/2388-15-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2388-11-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2388-12-0x000001D6BD610000-0x000001D6BD620000-memory.dmp
memory/2480-82-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2480-83-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2648-35-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2648-33-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2648-34-0x000001C5C6580000-0x000001C5C6590000-memory.dmp
memory/2848-30-0x000002047F8D0000-0x000002047F8E0000-memory.dmp
memory/2848-29-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2848-31-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2992-92-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/2992-93-0x00000183145F0000-0x0000018314600000-memory.dmp
memory/3192-18-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/3192-20-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/3192-19-0x0000025078FA0000-0x0000025078FB0000-memory.dmp
memory/3648-71-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/3648-72-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/3688-74-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/3688-76-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/3688-75-0x000001ABF2F10000-0x000001ABF2F20000-memory.dmp
memory/4132-57-0x0000021E3BE90000-0x0000021E3BEA0000-memory.dmp
memory/4132-56-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4132-58-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4368-85-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4368-86-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4440-61-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4440-60-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4628-69-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4628-67-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/4628-68-0x000001D01F520000-0x000001D01F530000-memory.dmp
memory/5056-37-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/5056-38-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/5056-22-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp
memory/5056-23-0x0000023FC7A90000-0x0000023FC7AA0000-memory.dmp
memory/5056-24-0x00007FFF68820000-0x00007FFF6920C000-memory.dmp