Behavioral task
behavioral1
Sample
sample.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
sample.exe
Resource
win10v2004-20230221-en
General
-
Target
sample.exe
-
Size
41KB
-
MD5
dd7804d05a1e5f5a0fda377efa92dfec
-
SHA1
23abbcb4e10ce64adf5bdcbd253bdfe1871f562b
-
SHA256
2d210b030636b118f22a4d0fd2fcec621561f8f842ae848c057bf4b8c78e6942
-
SHA512
37ced1daa8d2f84089943ecd68557fac06c631594e883c6082db74964f5dc65b99c00e3627616327d17c243afdfeafba10e39a7f11bc81605701b77bad958450
-
SSDEEP
768:JscG4ApfT6aWpDXswAuZkepWTjuKZKfgm3EhjN:WcKfnWkepWTSF7E1N
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/911224827111682089/zjAx02G-u4ZawsFRY1cZuRoths6rfWBCP7w303VMYCh_3eBCYJiGSWmFOMEX96b2V6nG
Signatures
-
Mercurialgrabber family
Files
-
sample.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ