Overview

overview

10

Static

static

3

IoFLauncher.exe

windows7-x64

10

IoFLauncher.exe

windows10-1703-x64

10

IoFLauncher.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    28-08-2023 06:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    IoFLauncher.exe

  • Size

    11.6MB

  • MD5

    124c2c589d0ba7dbc966123b3621ac5f

  • SHA1

    b15a3bc0ec613d3b7fd72125575c8b031d663bba

  • SHA256

    cebf8134aee3762147bed405c5e600631325e635b50d523ca913366dfa1afb7f

  • SHA512

    1752480298484c6c30f053e0791c8ad5bb913eaef082d46bfe085ff8bf5c1aa34fbae5b20fc0ac561ba0297a1017b6fa35dc93b1a5fce8641b3ea8d733ae6981

  • SSDEEP

    49152:tW125jirp0UyuMdH8offDzJzv8TxXF3ru66taoWRyswvmuT3ZaQYMiL4VYikt+6r:IU

Score
10/10
shurkinfostealerspywarestealer

Malware Config

Signatures

  • Shurk

    Shurk is an infostealer, written in C++ which appeared in 2021.

    infostealershurk
  • Shurk Stealer payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • GoLang User-Agent 3 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

Processes

  • C:\Users\Admin\AppData\Local\Temp\IoFLauncher.exe
    "C:\Users\Admin\AppData\Local\Temp\IoFLauncher.exe"
    1⤵
      PID:2132

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Unsecured Credentials

    2
    T1552

    Credentials In Files

    2
    T1552.001

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2132-1-0x0000000048790000-0x0000000048F42000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/2132-0-0x000007FFFF790000-0x000007FFFFFAB000-memory.dmp
      Filesize

      8.1MB

      Download
    • memory/2132-14-0x0000000048790000-0x0000000048F42000-memory.dmp
      Filesize

      7.7MB

      Download