Overview

overview

10

Static

static

10

I63f8affb2...ba.exe

windows7-x64

10

I63f8affb2...ba.exe

windows10-1703-x64

10

I63f8affb2...ba.exe

windows10-2004-x64

10

I63f8affb2...ba.exe

windows11-21h2-x64

10

Resubmissions

10-04-2024 02:45

240410-c88xlscb89 10

10-04-2024 02:45

240410-c88a3scb88 10

10-04-2024 02:45

240410-c8631scb86 10

10-04-2024 02:45

240410-c86ggscb85 10

14-10-2023 02:07

231014-cj7cgsba81 10

Analysis

  • max time kernel
    300s
  • max time network
    303s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-04-2024 02:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    I63f8affb2294c837814c33f5446924ba.exe

  • Size

    89KB

  • MD5

    dfb3936eb972928af9ec106505364786

  • SHA1

    06a05bf8d2675ea58e44d3fdc0d9e610be021ca8

  • SHA256

    2d1765fd2323db0b7a1b2a4413f793bb6b3a544ed7ba19c1b0d9c4db80747a93

  • SHA512

    e71c24d1804792be45281e70e97d909817e18d0948dcaf86b3e49d22d9f085278b8d043613f1fee0468a28f9e10218ac2cce3315e4c1575f242b324f606e950f

  • SSDEEP

    1536:/JVNAuC4/P1xAqm9wRC+IWMVYJGOupb1cus6SQsjhp5cNbMQaZ9bqk4gxmsuZmQ+:fN//HAqm9wRC+IWMVYJGOubXsjL5wvsD

Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Signatures

  • Detect Gurcu Stealer V3 payload 2 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\I63f8affb2294c837814c33f5446924ba.exe
    "C:\Users\Admin\AppData\Local\Temp\I63f8affb2294c837814c33f5446924ba.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4100
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "I63f8affb2294c837814c33f5446924ba" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\I63f8affb2294c837814c33f5446924ba.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3604
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:1920
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:3404
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "I63f8affb2294c837814c33f5446924ba" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:2304
        • C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
          "C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp6A43.tmp" -C "C:\Users\Admin\AppData\Local\jdm9hu6p1h"
            4⤵
              PID:3776
            • C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe
              "C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:1156
      • C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5068
        • C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4732
      • C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:968
        • C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2184
      • C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:32
        • C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:444
      • C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1772
        • C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1076
      • C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:2948
        • C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe
          "C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1652

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe
        Filesize

        89KB

        MD5

        dfb3936eb972928af9ec106505364786

        SHA1

        06a05bf8d2675ea58e44d3fdc0d9e610be021ca8

        SHA256

        2d1765fd2323db0b7a1b2a4413f793bb6b3a544ed7ba19c1b0d9c4db80747a93

        SHA512

        e71c24d1804792be45281e70e97d909817e18d0948dcaf86b3e49d22d9f085278b8d043613f1fee0468a28f9e10218ac2cce3315e4c1575f242b324f606e950f

        Download Submit

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\I63f8affb2294c837814c33f5446924ba.exe.log
        Filesize

        1KB

        MD5

        fc1be6f3f52d5c841af91f8fc3f790cb

        SHA1

        ac79b4229e0a0ce378ae22fc6104748c5f234511

        SHA256

        6da862f7c7feffca99cd58712ece93928c6ca6aed617f5d8c10a4718eaa2a910

        SHA512

        2f46165017309ee1a0c1b23e30a71e52e86ad8933e2649bf58c3f4628c5aa75659f5b8f6be32c2882f220b2f3ff2fd50d8766bf0a3708c94c2c634c051a05ea6

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        354B

        MD5

        3def4752622ec731573d3bd782c8362d

        SHA1

        3aff05164d0bed2d3d2fc37ec7087cd1cc3b8f20

        SHA256

        33082ace2ce1b80b06b55bc025808f0b092eb03732468817e18350a511dc9e0f

        SHA512

        8af90b545eb66f4009581b37f5df5b8c73130685eb16c5ec0169e12bdb7aca6266dbdbcef0e3a9d7a2ffa401c5b9b38351415c3c4e71c1e793a7523e20be1c8d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        472B

        MD5

        9c4f85a2d95c148b1bf4ca0e041ef5f6

        SHA1

        199563a34e995f7943bf9495fbe0ed632c8f436e

        SHA256

        98c4b715866d1c29a62747de80f5f27d796cfc617de1873bbcbfc8d71a35daf6

        SHA512

        042f085329a9d3c541603c307012e706fa7d3571cd4e533762c588e434bebcd1361e6cf82ee1ddfe3a256077d526a867e696699b1cb4829d2b519543cefb50f9

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        590B

        MD5

        58822e4bf81013c6e47a4441e9bd794a

        SHA1

        0e06879a2c5e4c0ce256c81a16cbd6941b77ec47

        SHA256

        50b0fc1cff4676de502070fc629d396fe01bd3c519e54570a1a581359cfc53c8

        SHA512

        83571e1e11d6191d2616ffce477aceeb75e4e98d9182c714841b9648fb502cbc4d30a15a237d3e46013b02574195d33cde72417dfd02ee9b37f76c62bf58ac04

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\installUtilLog.txt
        Filesize

        236B

        MD5

        4798ccc994ee7815b9beb03c173c49f9

        SHA1

        d5391b1dff126098dcfcc50eafd0ea0c8b0ca160

        SHA256

        7325e095c27632c96d81ebf1bf06fe613bdd7051463860b12996cb220772a4ca

        SHA512

        c6830415b29877b2e4a7537eb6a64500301ddc1517b26740a3950bcfe7d747bfdde4de3f9b08174c720204b6cdac9b2771cff7a6dd64455ab419cf83c69f655a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp6A43.tmp
        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

        Download Submit

      • C:\Users\Admin\AppData\Local\jdm9hu6p1h\data\cached-microdesc-consensus.tmp
        Filesize

        2.7MB

        MD5

        a0db8a87f7b723266c8b04255da46b06

        SHA1

        4df00ea56d22d88f3d2e005ef66bad5b3ef92ebf

        SHA256

        60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3

        SHA512

        41b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d

        Download Submit

      • C:\Users\Admin\AppData\Local\jdm9hu6p1h\data\cached-microdescs.new
        Filesize

        5.6MB

        MD5

        78c3dcc78709232fc859a2119e35d050

        SHA1

        9bf998b3a3c2b9784be091a191a6e53f0a66e6a1

        SHA256

        6daf4c31e602cf17c4bcb228e6895469d9f557e765c6e709dd0225207e9578ad

        SHA512

        da40c5411a9fa2b0dd848f0e4fe00bf6cc06c628bc4d0dd69021132cf26db8b5e7fa781d2aa4265bc2133d9d1e39cee0f95862f6ab367934b990a7c42d0a90be

        Download Submit

      • C:\Users\Admin\AppData\Local\jdm9hu6p1h\host\hostname
        Filesize

        64B

        MD5

        c9a0a08a33fde2618c6dd018a3a495a9

        SHA1

        d4fd03e00d89e354e8fc9fb8f93f7ceacc97fd2b

        SHA256

        e542c023776cdb05cc99f66333632ed69e9fc26cb0e4da93cf5bd1ca05ee6964

        SHA512

        6e3e5a22526368bacf99d4185544f94acfb6707ba4827adc877f795e12922788d9b91efc6aa321365b8f2a10ce47709f1d0f0fc79c28ab703057c42e5930c800

        Download Submit

      • C:\Users\Admin\AppData\Local\jdm9hu6p1h\port.dat
        Filesize

        4B

        MD5

        0d59701b3474225fca5563e015965886

        SHA1

        28311f41b614798b9a42a4bea40f02785a6b0d5d

        SHA256

        78a69c6fdc7b95f502f14d3c826b21528318ef248796d5a41478096973dd1ad6

        SHA512

        695030a1f182256de88aa0a0f2c6d644aceeef1e20a550263fdb4f901f39c05ccf647c7cbcad7e47b5c3691f9f0302e2c0456af954b156e7ceca057991fe3b13

        Download Submit

      • C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe
        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

        Download Submit

      • C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt
        Filesize

        218B

        MD5

        89b4e83cbc5a68f75dfb7e49524b562f

        SHA1

        304f01b5b1887aca3d2d2ca9d3dda594ac0e6bd2

        SHA256

        3836ab1947c3836c655beb97ba4fef320d4eba1a505ce028fd578e532821e9c5

        SHA512

        caaf096a684d0ce61f15c2500fa8b788efc2b8bfbc7a77bcae376d8fd9e24df5b401d5fb09f2feb21b75ba141beb046da12719b42db8910f73e748f12ddc790f

        Download Submit

      • memory/32-104-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/32-100-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/968-89-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/968-94-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/968-90-0x0000025ABCDD0000-0x0000025ABCDE0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/1772-111-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1772-106-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1772-107-0x0000020D9FA90000-0x0000020D9FAA0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2948-126-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2948-122-0x000001B766400000-0x000001B766410000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2948-121-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2952-64-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2952-11-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/2952-69-0x000001D649150000-0x000001D649160000-memory.dmp

        Filesize

        64KB

        Download

      • memory/2952-12-0x000001D649150000-0x000001D649160000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4100-2-0x00000279D79E0000-0x00000279D79F0000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4100-6-0x00007FFA35910000-0x00007FFA363D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4100-1-0x00007FFA35910000-0x00007FFA363D1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4100-0-0x00000279BD2E0000-0x00000279BD2FC000-memory.dmp

        Filesize

        112KB

        Download

      • memory/5068-79-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/5068-75-0x00007FFA351A0000-0x00007FFA35C61000-memory.dmp

        Filesize

        10.8MB

        Download