Behavioral task
behavioral1
Sample
LOLXD.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
LOLXD.exe
Resource
win10v2004-20221111-en
General
-
Target
LOLXD.exe
-
Size
42KB
-
MD5
e3d545e230f7e5bb4948716c63a8b851
-
SHA1
e25b168d3e9dd8eeafe6722c1fff7b8f4ecb2a64
-
SHA256
40d90e4a38dc265d047803df7e224f0d5d80fef69503296170e776213a3f6697
-
SHA512
d8309978995fba6bced265d98a2f716db74087cbcf46e42f10f518440122b7835fd8a5a76f336a0fad2b88d705509b8efc3f721749947072b88cd94f8c3aee76
-
SSDEEP
768:jE5jFn8rdgOpRTs+ZewuZ2Lf8lTjOKZKfgm3Ehmp:dxpRTNZZLf8lTaF7Ekp
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1063818888372035674/Cr-rpmPnLJwltx1y4iKFbEtWHEItxwUz_xjBPlrsOtbWgXZr1elASq8XP6KoqAJY1NRu
Signatures
-
Mercurialgrabber family
Files
-
LOLXD.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ