Overview

overview

10

Static

static

3

update/Update.exe

windows7-x64

10

update/Update.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2024 12:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    update/Update.exe

  • Size

    5.6MB

  • MD5

    3d3c49dd5d13a242b436e0a065cd6837

  • SHA1

    e38a773ffa08452c449ca5a880d89cfad24b6f1b

  • SHA256

    e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

  • SHA512

    dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

  • SSDEEP

    98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6s:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciY

Score
10/10
gurcumilleniumratpersistenceratspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\update\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\update\Update.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB391.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpB391.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4544
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 4064"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:4260
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:1004
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:3336
        • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
          "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3608
            • C:\Windows\system32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
              5⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:3228
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:748
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2400

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log
        Filesize

        1KB

        MD5

        9e8cab527db784fa373e8b3ee2809029

        SHA1

        b1fea2a154908c1a0bfc476f0279f44dbb89249c

        SHA256

        84c010466cd6465eec0ac04f1aa37652cf4ed3532e7981ac0fb59df855d7cc4c

        SHA512

        f238dd04fa22540bd10803fd59d49944511df1b340b4a68f0c096c45498e6c58218d07768ad0572ed8886bb5b20053e42adf235447065bbbfa0e6d9fd77e9cfc

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll
        Filesize

        1.7MB

        MD5

        65ccd6ecb99899083d43f7c24eb8f869

        SHA1

        27037a9470cc5ed177c0b6688495f3a51996a023

        SHA256

        aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

        SHA512

        533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmpB391.tmp.bat
        Filesize

        256B

        MD5

        23eca5b6620173c2bc6099a4599aed70

        SHA1

        0d6a9ccb1a4db535f7ec7daffd52a9a4efdd1892

        SHA256

        c668f015941550887cf9687cbf4c20ece91fbe95523b50cb1277aebcdd80daae

        SHA512

        80d2513b30d58098acb5c381ec2030e4bf8c70d47cf4529023d2a5b8301b9012309096188a92b15db55e29aa470eaaff955dc805d39cbbf224c2e536dd33c4e2

        Download Submit

      • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
        Filesize

        5.6MB

        MD5

        3d3c49dd5d13a242b436e0a065cd6837

        SHA1

        e38a773ffa08452c449ca5a880d89cfad24b6f1b

        SHA256

        e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

        SHA512

        dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

        Download Submit

      • memory/748-55-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-57-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-58-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-56-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-47-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-54-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-59-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-53-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-49-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/748-48-0x0000024C73850000-0x0000024C73851000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2164-24-0x00000210FEB30000-0x00000210FEB6A000-memory.dmp

        Filesize

        232KB

        Download

      • memory/2164-43-0x00000210FEB70000-0x00000210FEB82000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2164-25-0x00000210FD5C0000-0x00000210FD5E6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2164-21-0x00000210FEA80000-0x00000210FEAEA000-memory.dmp

        Filesize

        424KB

        Download

      • memory/2164-20-0x00000210FD5B0000-0x00000210FD5BA000-memory.dmp

        Filesize

        40KB

        Download

      • memory/4064-0-0x00007FF8EF9C3000-0x00007FF8EF9C5000-memory.dmp

        Filesize

        8KB

        Download

      • memory/4064-12-0x00007FF8EF9C0000-0x00007FF8F0481000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4064-8-0x000001C0F9F20000-0x000001C0F9F3E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4064-7-0x00007FF8EF9C0000-0x00007FF8F0481000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/4064-6-0x000001C0F9FE0000-0x000001C0FA056000-memory.dmp

        Filesize

        472KB

        Download

      • memory/4064-1-0x000001C0DF5C0000-0x000001C0DFB60000-memory.dmp

        Filesize

        5.6MB

        Download