Static task
static1
Behavioral task
behavioral1
Sample
Lightcord.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral2
Sample
Lightcord.exe
Resource
win11-20220223-en
General
-
Target
Lightcord.exe
-
Size
403KB
-
MD5
d88a96e4157452dc416d3a18cafdd586
-
SHA1
bad5d00009537cbd3d2df977256256f681dd9d52
-
SHA256
a0b60ad2e8131a78501226d6f6a480229abff101e5d4adda8ba049a9c6d0c990
-
SHA512
3b3f419c48e943d2a59489e85a0c3b33e8a2b8a2403077def255b24638adedaaddafede44518bc5b607900af239db0cc1d331897faf9133b0b02cfaf90038090
-
SSDEEP
1536:EAxxor1B5L4KTGF7EBmUoTM2LERxZ0Czaot9CB2g03Cka3FfrtOl+deJrK75OFR+:S1B5L/TGF7EBmUoYTRxfzaob0tDOlTP
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/982629552608124928/23-ImtXuZTh_wpqQcta3ov1X0aPSELoBGNlPzLh2qKTbFVVNkfWIjV0e4RyZYUNYloyR
Signatures
-
Mercurialgrabber family
Files
-
Lightcord.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 363KB - Virtual size: 362KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ