Resubmissions
10-04-2024 02:45
240410-c88xlscb89 1010-04-2024 02:45
240410-c88a3scb88 1010-04-2024 02:45
240410-c8631scb86 1010-04-2024 02:45
240410-c86ggscb85 1014-10-2023 02:07
231014-cj7cgsba81 10Analysis
-
max time kernel
293s -
max time network
305s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
10-04-2024 02:45
General
-
Target
I63f8affb2294c837814c33f5446924ba.exe
-
Size
89KB
-
MD5
dfb3936eb972928af9ec106505364786
-
SHA1
06a05bf8d2675ea58e44d3fdc0d9e610be021ca8
-
SHA256
2d1765fd2323db0b7a1b2a4413f793bb6b3a544ed7ba19c1b0d9c4db80747a93
-
SHA512
e71c24d1804792be45281e70e97d909817e18d0948dcaf86b3e49d22d9f085278b8d043613f1fee0468a28f9e10218ac2cce3315e4c1575f242b324f606e950f
-
SSDEEP
1536:/JVNAuC4/P1xAqm9wRC+IWMVYJGOupb1cus6SQsjhp5cNbMQaZ9bqk4gxmsuZmQ+:fN//HAqm9wRC+IWMVYJGOubXsjL5wvsD
Malware Config
Signatures
-
Detect Gurcu Stealer V3 payload 2 IoCs
-
Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
-
Executes dropped EXE 12 IoCs
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 18 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\I63f8affb2294c837814c33f5446924ba.exe"C:\Users\Admin\AppData\Local\Temp\I63f8affb2294c837814c33f5446924ba.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "I63f8affb2294c837814c33f5446924ba" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\I63f8affb2294c837814c33f5446924ba.exe" &&START "" "C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650013⤵
-
-
C:\Windows\system32\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /create /tn "I63f8affb2294c837814c33f5446924ba" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe"C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\tar.exe"C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp57B5.tmp" -C "C:\Users\Admin\AppData\Local\jdm9hu6p1h"4⤵
-
-
C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe"C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"4⤵
- Executes dropped EXE
-
-
-
-
C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exeC:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe"C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exeC:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe"C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exeC:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe"C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exeC:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe"C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exeC:\Users\Admin\AppData\Local\EsetSecurity\I63f8affb2294c837814c33f5446924ba.exe1⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe"C:\Users\Admin\AppData\Local\jdm9hu6p1h\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\jdm9hu6p1h\torrc.txt"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5dfb3936eb972928af9ec106505364786
SHA106a05bf8d2675ea58e44d3fdc0d9e610be021ca8
SHA2562d1765fd2323db0b7a1b2a4413f793bb6b3a544ed7ba19c1b0d9c4db80747a93
SHA512e71c24d1804792be45281e70e97d909817e18d0948dcaf86b3e49d22d9f085278b8d043613f1fee0468a28f9e10218ac2cce3315e4c1575f242b324f606e950f
-
Filesize
1KB
MD5081b644082c51f2ff0f00087877003b5
SHA12eeb0a8a592e5327873f5a6704031c1ff6d0bd31
SHA256cc427c714517dd0a3c96354869ce1bb300bf4935006fc628ceb28e2f040197ac
SHA51295621587e55a5f5111aea05cadbaf56429adde2de0c41c9de8e74c03d31116edf72b63d76f65af45e4b14b68fe214926425581f77113d332eb91b0b6a5598eff
-
Filesize
354B
MD57fd51ae2969aeca93803bd227becbe8e
SHA1044caf3452aefeaf2c4dd6a964d2d54514941b04
SHA25634c307f9f8e866e0d5307055065276a2b68130a56ae4ac545c6c9fe6ab6191fe
SHA51213636dc348b56772a79269b9bc0a0081a2da9107805933b8fdd575bf88662b2fd5a36815e2bae71126ff7b5f8e289df9b88918b0a970957fb584c6aa351c9958
-
Filesize
472B
MD51656b5d4acde13bfff56d78c8817295b
SHA182f05cc4e3972f505369ac7f90d0e3f497ee625f
SHA2560d489db2f2a5bccc092182a9c0de388d4fa5fd4098aac4d437b5b0ef18dde127
SHA512fc8ea10898677a27d22bc8f9f67ca7e42dafd5c157786e3f21b652ec8aef9717f27f164e031651b83728dadd2085930ebcfd06170aae0c0bb3cf449e83d537c1
-
Filesize
590B
MD591baa4bf7871ad17ea49716f59d6c263
SHA100a8bcc3d09ad99a4a3aef65769e314806c153c6
SHA2562aebafdd03e72e74e929fe99c6f1f2efd18a51faf51dda381aca1f550de467ec
SHA5126eafb401b2cec051a6becb6f1e76b2761114854ebf5ede3ed9c46e628b81abc0c926d4aab4181a0d7ee5239bef1830e84b650f8bb4a5e94445ee370e055a286d
-
Filesize
118B
MD50b9909fadac49f093fa73c5b1a00b455
SHA17ed93fbaae384226d08849fa69d5f997573b1b60
SHA256664a0c3ad4d12255c58a067e32a1616b1fa3d3cb2c327d6bbb0407872ccda7ff
SHA512b4f7b2fb0d3360be56d989b05a51685ee2f75df4f8086e1e5541102a93355cfaa2a9848bda44dfc3b256d7277cf9fa9b6068bd634ab8b6707b1ca4be25bdac60
-
Filesize
13.3MB
MD589d2d5811c1aff539bb355f15f3ddad0
SHA15bb3577c25b6d323d927200c48cd184a3e27c873
SHA256b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12
SHA51239e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289
-
Filesize
2.7MB
MD5a0db8a87f7b723266c8b04255da46b06
SHA14df00ea56d22d88f3d2e005ef66bad5b3ef92ebf
SHA25660b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3
SHA51241b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d
-
Filesize
7.3MB
MD535686fb9091b683b82e641f316cded3b
SHA1e0cc734232da68052665e316dd3ad232d1329680
SHA25614db023f7a50b6aa8c41af55bcc4e0d7dc3b85ee98623fc07c1c22d10a1971c5
SHA51248b8c9f05965d31584001d0f0a6723f0fd52f7f1dcfe9168a6b6894f1d62503121b41dde10ca373a03a6d04a6faa2b0539b3b72a3eafddd0807ab1a5ebfe7386
-
Filesize
64B
MD5d8e9b439ce5742b31f068df29edbd651
SHA151e4a98165bbe02f229dacb17b0eb793cb1bb99b
SHA2568f48c12d0d3fc2df9a03e2a4db4e1a5c6ae2f4d9507de753d4d352f0871964cc
SHA512016f89e528ae1353e40e94c0194cebb70430befef247ed7da1ff6976f184a4f0ddebbca59fb485f523dd4aaff6caa5daa1c6a9a91bad791ec464627f4fbe12ce
-
Filesize
4B
MD5333ac5d90817d69113471fbb6e531bee
SHA19edd4e291a67381bace3ea4e5c60e1cc34c9e78e
SHA256f2bdda2192b2a979569c4ccbd78d665175e0225c0435031d1341f9cf8021606e
SHA512059dec0962c116cd181e7cbf956b52150c8a6e8dc75aec3a970fe1adaf78b1ac430500e6cad1b910d4cdb97be51c8b6e8f80dce4cb52059a3472c2e6fc5c2525
-
Filesize
7.4MB
MD588590909765350c0d70c6c34b1f31dd2
SHA1129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7
SHA25646fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82
SHA512a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192
-
Filesize
218B
MD581ef5bcd221bc632c756af88ae2e5a36
SHA1c0f8ac33ddc436e32e53b959a8b7e4b52e472d39
SHA256886ddc9c312adec286b33ce7981792528f93b1f4da5e8d2d1931f13292604bd0
SHA5127dd4be91799cde6a0a5c2a83105abcde66544752f44f3620feb9736f14e8e95edc468b4bfe583dcf1daff76023ceef6657e3589a7c8897b849cfe603859935cb
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
112KB
-
Filesize
10.8MB