Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20220414-en
General
-
Target
1.exe
-
Size
42KB
-
MD5
00841011b7fb27a7d4e1285858f8738a
-
SHA1
6c557342e8a5f823303a3ffddfcdcccf32e8a1a1
-
SHA256
16523e9c21213d7d8fa9682c814c3745753991089d871ed20b9eff0510bada5f
-
SHA512
b1247ea28e6a27b789708f87131c39a8b1b0b2d9f3e79d3762b307539eaeccda75967db038456b31d418bb1ff73c8348756260115b465129dd6db7b1482f04bc
-
SSDEEP
768:l5V3/YnsSlzV3iquZPLD3TjqKZKfgm3EhZO:lXwsCzV3i7LD3TGF7E3O
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/860371063619452988/FvhljCxs2QJczKaUatmDAK01uhu2FzQHuDgLyJt47-ZaOMgvHL-7x72yciIQi5mEkUOn
Signatures
-
Mercurialgrabber family
Files
-
1.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ