gurcu | 7cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e

General

Target
sub_7cba781d5691.exe
Size 154KB
Sample260524-bzassahs3x
SHA256 7cba781d569196e89a86f10cee7d69918fe05df1461d1f0ed3426ccb2046002e
MD5 c426f46f2c074eda8c903f9868be046d
SHA1 d0352482370beff107eb2b2f13e2de275fbc91c7
SHA512 97eed1bad31bd2e558d2cf6ff3c3026d828f561e2d1439f0daca420f53a3c6b1d59442f043357be9a33761a8e99ac935d08239d2e50811d47909cec8caad7c05
SSDEEP 3072:d0Elo8nshOJIlE+/sY3I9bf4gDJVYRhYKdDrQOu:dPlo8sh8+EY3I9bfdDbcyO
TLSH
T1F5F3F95BB2409FA4D15E8E72A1B213314360D9079E81BF4A5D9BE4D02DD32C6AB136FF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

collection discovery gurcu persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7720988404:AAHJ1d0so4FzXOrfQavDsW60uUFev7BQSjU/sendMessage?chat_id=1660795749
http://147.124.221.201:8080
http://209.38.221.184:8080
http://46.235.26.83:8080
http://147.28.185.29:80
http://206.166.251.4:8080
http://51.159.4.50:8080
http://167.235.70.96:8080
http://194.164.198.113:8080
http://132.145.17.167:9090
https://5.196.181.135:443
http://116.202.101.219:8080
https://185.217.98.121:443
http://185.217.98.121:8080
http://159.203.174.113:8090
http://107.161.20.142:8080
https://192.99.196.191:443
http://65.49.205.24:8080
https://154.9.207.142:443
http://67.230.176.97:8080
http://8.222.143.111:8080
http://8.219.110.16:9999
http://41.87.207.180:9090
http://38.207.174.88:8080
http://185.217.98.121:80
http://18.228.80.130:80
http://168.138.211.88:8099
http://129.151.109.160:8080
http://20.78.55.47:8080
http://8.216.92.21:8080
https://138.2.92.67:443
http://38.60.191.38:80
http://101.126.19.171:80
http://47.96.78.224:8080
http://101.43.160.136:8080

Signatures

Family: Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
stealer gurcu
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1896	cmd.exe
3832	netsh.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
5192	sub_7cba781d5691.exe
5192	sub_7cba781d5691.exe
5192	sub_7cba781d5691.exe
5192	sub_7cba781d5691.exe
5192	sub_7cba781d5691.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	5192	sub_7cba781d5691.exe
Token: SeCreateTokenPrivilege	5192	sub_7cba781d5691.exe
Token: SeAssignPrimaryTokenPrivilege	5192	sub_7cba781d5691.exe
Token: SeIncreaseQuotaPrivilege	5192	sub_7cba781d5691.exe
Token: SeSecurityPrivilege	5192	sub_7cba781d5691.exe
Token: SeTakeOwnershipPrivilege	5192	sub_7cba781d5691.exe
Token: SeLoadDriverPrivilege	5192	sub_7cba781d5691.exe
Token: SeSystemtimePrivilege	5192	sub_7cba781d5691.exe
Token: SeBackupPrivilege	5192	sub_7cba781d5691.exe
Token: SeRestorePrivilege	5192	sub_7cba781d5691.exe
Token: SeShutdownPrivilege	5192	sub_7cba781d5691.exe
Token: SeSystemEnvironmentPrivilege	5192	sub_7cba781d5691.exe
Token: SeUndockPrivilege	5192	sub_7cba781d5691.exe
Token: SeManageVolumePrivilege	5192	sub_7cba781d5691.exe
Token: 31	5192	sub_7cba781d5691.exe
Token: 32	5192	sub_7cba781d5691.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 1896	5192	sub_7cba781d5691.exe	80
PID 1896 wrote to memory of 4756	1896	cmd.exe	82
PID 1896 wrote to memory of 3832	1896	cmd.exe	83
PID 1896 wrote to memory of 3756	1896	cmd.exe	84
PID 5192 wrote to memory of 4900	5192	sub_7cba781d5691.exe	85
PID 4900 wrote to memory of 2020	4900	cmd.exe	87
PID 4900 wrote to memory of 3092	4900	cmd.exe	88
PID 4900 wrote to memory of 3480	4900	cmd.exe	89

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Office\20.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	sub_7cba781d5691.exe

C:\Users\Admin\AppData\Local\Temp\sub_7cba781d5691.exe
"C:\Users\Admin\AppData\Local\Temp\sub_7cba781d5691.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:5192
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show profiles|findstr /R /C:"[ ]:[ ]"
  2⤵
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:1896
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4756
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3832
- - C:\Windows\system32\findstr.exe
    findstr /R /C:"[ ]:[ ]"
    3⤵
    PID:3756
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c chcp 65001 && netsh wlan show networks mode=bssid | findstr "SSID BSSID Signal"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2020
- - C:\Windows\system32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3092
- - C:\Windows\system32\findstr.exe
    findstr "SSID BSSID Signal"
    3⤵
    PID:3480