Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/04/2024, 02:28

240410-cyaxtsca43 10

10/04/2024, 02:28

240410-cx45aaca36 10

10/04/2024, 02:28

240410-cx4hrafc61 10

10/04/2024, 02:28

240410-cx37zsfc6y 10

14/10/2023, 01:16

231014-bm3ysshd6t 10

Analysis

  • max time kernel
    598s
  • max time network
    602s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2024, 02:28

General

  • Target

    m1f1f3a069223072f8d6802a079235d.exe

  • Size

    306KB

  • MD5

    4b36dcaa94c3eca48a6292bd670ffe79

  • SHA1

    705484e61ac39ba02cc80903be0da6ce74333334

  • SHA256

    c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9

  • SHA512

    cf07d7f80264554eb3b945421ca41db38ff79707775d355d478c09f4b64d14f523339295aa4bc9b79c0dbb004e6756585bcf85edc8cbc2d16f7f0481be93513a

  • SSDEEP

    3072:71E/yXS0m2pOVLVewP2D/kIyC+mvXi1QJIkjXAToknBq9tT/8RJ6W3t3dpdQGqKI:7E2mDMtqa5EOTeKXAllKD9bmTneefA

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot6209822134:AAHQxD-CI1YDVcNbXijXHlonsEUgv3dfYtg/sendMessage?chat_id=-1001529292045

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 22 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe
    "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\m1f1f3a069223072f8d6802a079235d.exe" &&START "" "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4820
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:3944
        • C:\Windows\system32\PING.EXE
          ping 127.0.0.1
          3⤵
          • Runs ping.exe
          PID:2476
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "m1f1f3a069223072f8d6802a079235d" /sc MINUTE /tr "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe" /rl HIGHEST /f
          3⤵
          • Creates scheduled task(s)
          PID:3336
        • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
          "C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • outlook_office_path
          • outlook_win_path
          PID:4804
          • C:\Windows\System32\tar.exe
            "C:\Windows\System32\tar.exe" -xvzf "C:\Users\Admin\AppData\Local\Temp\tmp3F99.tmp" -C "C:\Users\Admin\AppData\Local\d67800nkmj"
            4⤵
              PID:5036
            • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
              "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
              4⤵
              • Executes dropped EXE
              PID:1608
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3436
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3064
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:264
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1432
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3076
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3812
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3988
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3636
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3616
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:4148
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:3668
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1484
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1280
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:888
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1516
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:1480
      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe
        1⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:900
        • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe
          "C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe" -f "C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt"
          2⤵
          • Executes dropped EXE
          PID:2240

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\m1f1f3a069223072f8d6802a079235d.exe.log

        Filesize

        847B

        MD5

        3308a84a40841fab7dfec198b3c31af7

        SHA1

        4e7ab6336c0538be5dd7da529c0265b3b6523083

        SHA256

        169bc31a8d1666535977ca170d246a463e6531bb21faab6c48cb4269d9d60b2e

        SHA512

        97521d5fb94efdc836ea2723098a1f26a7589a76af51358eee17292d29c9325baf53ad6b4496c5ca3e208d1c9b9ad6797a370e2ae378072fc68f5d6e8b73b198

      • C:\Users\Admin\AppData\Local\TeamViewer\m1f1f3a069223072f8d6802a079235d.exe

        Filesize

        306KB

        MD5

        4b36dcaa94c3eca48a6292bd670ffe79

        SHA1

        705484e61ac39ba02cc80903be0da6ce74333334

        SHA256

        c2e57e9b6e52a5429ae7a7bd36c57f63589d78fbf0ffe5760ada4a67b9fadec9

        SHA512

        cf07d7f80264554eb3b945421ca41db38ff79707775d355d478c09f4b64d14f523339295aa4bc9b79c0dbb004e6756585bcf85edc8cbc2d16f7f0481be93513a

      • C:\Users\Admin\AppData\Local\Temp\tmp3F99.tmp

        Filesize

        13.3MB

        MD5

        89d2d5811c1aff539bb355f15f3ddad0

        SHA1

        5bb3577c25b6d323d927200c48cd184a3e27c873

        SHA256

        b630008f6d3887793d48b87091e56691e292894dd4fa100dc4a418a2f29dcc12

        SHA512

        39e576124c54143520c5435a2ef9b24506131e13403489c0692f09b89135015d611c4988d4772f8a1e6557fa68b4667d467334461009cee8c2227dfc3e295289

      • C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdesc-consensus.tmp

        Filesize

        2.7MB

        MD5

        a0db8a87f7b723266c8b04255da46b06

        SHA1

        4df00ea56d22d88f3d2e005ef66bad5b3ef92ebf

        SHA256

        60b43cdce0f807f7891521f396f53def34a7d98986dbde0faa2a197189c587f3

        SHA512

        41b8fc467d11af7ca6a42c7e94d1b8295ab3ae5d6d186b4f378e6e079440520e8324b695da1134beb2bc1697d2491edcc70c1b75ab6fc66b9c1cb2ecbcdb4a7d

      • C:\Users\Admin\AppData\Local\d67800nkmj\data\cached-microdescs.new

        Filesize

        7.1MB

        MD5

        1688705d247f5371ff5dfffc023f62e2

        SHA1

        4b922f119dc20b845edfb5c249da06349a6b2450

        SHA256

        e36691df7629faa18980ecb8203ee6982bc1eee97a9b7b8617388a25b8c36bf4

        SHA512

        99155769cd8887960931645cef9cdabc89fecee87a00082decf14314ec520d82b1540b7224bbf625e732a1579b846a7e9bbb0d97a05a54d3c84ade3cd54e11eb

      • C:\Users\Admin\AppData\Local\d67800nkmj\host\hostname

        Filesize

        64B

        MD5

        a2dff20e590e91528be5489769f66cf9

        SHA1

        a985b0ecb4f0f50fa5be514d90ddd64be5f41f50

        SHA256

        d8efa969e8647e1f705ac859254df36d75d59425980b818ac2b1d723f05e408e

        SHA512

        26239bbb7cb00e9c1fe3d63c6d046564f3e3e322d5731e073dfd085056726291772b2d6cda9e1406a4b80383bbedcace38850e3e6f95af92ad8d367c1387face

      • C:\Users\Admin\AppData\Local\d67800nkmj\port.dat

        Filesize

        4B

        MD5

        878a0658e652765c4979dba411787e43

        SHA1

        3fa79e5d234b35dc7ebdf6b9c4661bf621e96f8d

        SHA256

        4694198984395866f16672b054993e24292cdfd7524af731f7db024a62e3271d

        SHA512

        57210b52e1a9b89985eb3f86707cf1169d51cc4e864fef22c56cdcf3b978fb3a864e6ee323384ded29e0c2d3fdaba052d43dc711a1175944a5942fca3aec8096

      • C:\Users\Admin\AppData\Local\d67800nkmj\tor\tor.exe

        Filesize

        7.4MB

        MD5

        88590909765350c0d70c6c34b1f31dd2

        SHA1

        129b27c3926e53e5df6d44cc6adf39c3a8d9ebf7

        SHA256

        46fe244b548265c78ab961e8f787bc8bf21edbcaaf175fa3b8be3137c6845a82

        SHA512

        a8af08d9169a31a1c3419d4e6e8fbe608c800d323840563b5a560d3e09e78a492201f07cc0d3864efbff8ad81e59885fc43a6b749e0a3377aa8555df258af192

      • C:\Users\Admin\AppData\Local\d67800nkmj\torrc.txt

        Filesize

        218B

        MD5

        b1c16b190654ef15b6e710cdb2ab2f96

        SHA1

        b9f07db1a151a686dda8a8accb854681dac5765e

        SHA256

        0bb4a1b1aff58e0754c3eb3796ab581b6589117f9f9788ea2bdb54ae1af69ef0

        SHA512

        9da9ed5ac3e2fbe69281277fe22d086cb16fca88e67bfd2d95612b7fa187f592582efeb35a326491be798a24a7417ba15247110ec33394ac31606a6e490c89fb

      • memory/264-69-0x0000021D7F230000-0x0000021D7F240000-memory.dmp

        Filesize

        64KB

      • memory/264-68-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/264-71-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/868-155-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/868-153-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/900-167-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/900-165-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/1120-4-0x0000028C42D00000-0x0000028C42D10000-memory.dmp

        Filesize

        64KB

      • memory/1120-6-0x00007FF9802A0000-0x00007FF980D61000-memory.dmp

        Filesize

        10.8MB

      • memory/1120-1-0x00007FF9802A0000-0x00007FF980D61000-memory.dmp

        Filesize

        10.8MB

      • memory/1120-0-0x0000028C28640000-0x0000028C28692000-memory.dmp

        Filesize

        328KB

      • memory/1484-141-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/1484-143-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/1516-157-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/1516-159-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/2240-129-0x000001B19A310000-0x000001B19A320000-memory.dmp

        Filesize

        64KB

      • memory/2240-131-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/2240-128-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3076-94-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3076-95-0x0000021626CA0000-0x0000021626CB0000-memory.dmp

        Filesize

        64KB

      • memory/3076-97-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3436-62-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3436-59-0x000002AEA5270000-0x000002AEA5280000-memory.dmp

        Filesize

        64KB

      • memory/3436-58-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3616-122-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3616-120-0x00000257EE710000-0x00000257EE720000-memory.dmp

        Filesize

        64KB

      • memory/3616-119-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3988-109-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/3988-107-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/4804-12-0x000001E669280000-0x000001E669290000-memory.dmp

        Filesize

        64KB

      • memory/4804-49-0x000001E669280000-0x000001E669290000-memory.dmp

        Filesize

        64KB

      • memory/4804-48-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB

      • memory/4804-11-0x00007FF97ECC0000-0x00007FF97F781000-memory.dmp

        Filesize

        10.8MB