7900f7e9e009679cb581de76d7535e55ec92ac7aca7074dbdb24c6e28baf7b0e

Analysis

Target

Mercurial.exe
Size

7.9MB
MD5

8cad58c674edbe5bafe3a7f3b690e450
SHA1

ba629864335ffef2a62808384087deb45342b755
SHA256

7900f7e9e009679cb581de76d7535e55ec92ac7aca7074dbdb24c6e28baf7b0e
SHA512

e0a5936c75920cd35e2ee96d7810c932a77a5cdc7752e75af660069ba88016cbb75dcd17fe944e86ecdd6083e1066dab4abb4ebd36bb019d81982cc39653a125

Score

7^/10

spyware stealer

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Mercurial.exe

pid process

636 Mercurial.exe
636 Mercurial.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Mercurial.exe

description pid process

Token: SeDebugPrivilege 636 Mercurial.exe

pid	process
636	Mercurial.exe
636	Mercurial.exe

description	pid	process
Token: SeDebugPrivilege	636	Mercurial.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Mercurial.exe

description	pid	process	target process
PID 636 wrote to memory of 368	636	Mercurial.exe	nslookup.exe
PID 636 wrote to memory of 368	636	Mercurial.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\system32\nslookup.exe
  nslookup -type=mx 154.61.71.13
  2⤵
  PID:368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact