Analysis
-
max time kernel
191s -
max time network
194s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
18-04-2023 19:35
General
-
Target
Mercurial.exe
-
Size
3.2MB
-
MD5
a9477b3e21018b96fc5d2264d4016e65
-
SHA1
493fa8da8bf89ea773aeb282215f78219a5401b7
-
SHA256
890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
-
SHA512
66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
-
SSDEEP
98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07
Malware Config
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ajgrwl1\5ajgrwl1.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C66.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB0EF215E766F40BBAD94D7AC5C1D1CC.TMP"3⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\output.exe"C:\Users\Admin\AppData\Local\Temp\output.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4996 -s 19202⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c66e66ebc0490d029b297769ba2d2256
SHA1687ed6585cac2b8ec6b4bc98714ce1752499e928
SHA25694e2efa2bd6480d7265d08379c82c50182c3e6b0230a3a70e9c674d5c664705a
SHA512c182d16e4ddd57677e8419c12db68bfd9318d74da7a64d5eec58720a789526ab3ff971e282b13e9876a41e3b506dad4d5cbff48f83f5fc70604fca42f34c6c41
-
Filesize
41KB
MD5bf67d5e42d55899ea800e6daa3afd271
SHA1cea9873cfb4da568802595046fc81956a2c830ed
SHA256f7a544151a58d3955b70deb0b476741d9842024a417bb0b055d353cf652f06d5
SHA512263f58b57a844c4610ec563344742aa474b93b716e0a72f8e6b8303841c74665ccb2919ea9ff2b16f1980f1e709b7a77b6472956198e84740de2a6ebea3c5539
-
Filesize
41KB
MD5bf67d5e42d55899ea800e6daa3afd271
SHA1cea9873cfb4da568802595046fc81956a2c830ed
SHA256f7a544151a58d3955b70deb0b476741d9842024a417bb0b055d353cf652f06d5
SHA512263f58b57a844c4610ec563344742aa474b93b716e0a72f8e6b8303841c74665ccb2919ea9ff2b16f1980f1e709b7a77b6472956198e84740de2a6ebea3c5539
-
Filesize
11KB
MD56e09c67b55a62916fc9204eff6877bf0
SHA15bdd02efc746008dbbb8704eecffbf34136b8695
SHA256a4962989573ad9ff719db89381e95c64f6e0be84f31d20d346a2df632b9c9adf
SHA512362aa38ddffeea66f1cb2ba7d42e2f0754c9b1b28a8e7b0f794ebcfc74043349e5ee9e2b58720af89d3612e0d6931b47ac12f11be274ca271227e8e622ef01e2
-
Filesize
5KB
MD58aab1997664a604aca551b20202bfd14
SHA1279cf8f218069cbf4351518ad6df9a783ca34bc5
SHA256029f57fa483bbcee0dd5464e0d4d89bd03032161424d0ffd1da2b3d5db15977f
SHA512cf0efea853d7e1997dcfcc9a73668ed9a5ac01cf22cbb7082a05abc141fccc7c92a936b245666071df75389cd7ebe60dc99b3c21279173fe12888a99034a5eda
-
Filesize
7KB
MD56fdae9afc1f8e77e882f1ba6b5859a4e
SHA133eb96f75ffe9a1c4f94388e7465b997320265a5
SHA256a365264dd2d3388acc38b2f5c8f3c267bbf83ca463f70fbf6c8459123a7cc33d
SHA51297bb77e8c9c7a1a46fa416a917787ddced3439f72ea35558f22fa2450fbbd11928f3442baec0b33b14576683baa6c1c6b3e1376bd7742da358c808bf07db28e9
-
Filesize
8KB
MD56ba707982ee7e5f0ae55ce3fa5ccad17
SHA1d094c98491058ed49861ce82701abe1f38385f18
SHA25619af9bea270f830354af8250cd82db32fdcab6327d139e2720713fb7d43a5797
SHA512d9cf480c32bfb806c72a2dc6fe211c4806388ccf548d55b059e633e8f814d46c80ef73eacfb02398fd3b1e75b7c44b8a1ba0b29476edbf9fe1b29322798d3cfa
-
Filesize
2KB
MD5fae5458a5b3cee952e25d44d6eb9db85
SHA1060d40137e9cce9f40adbb3b3763d1f020601e42
SHA256240478bb9c522341906a0ef376e0188ce6106856a26a3ae0f7b58af07a377a06
SHA51225f406f747518aef3a1c5c3d66e8bd474429b05ef994303c5f7bc5d3669d691d9dc21ea8f8a35e20b84f8c406bf89835f2f5007a8f743df755e67b4c380fa236
-
Filesize
4KB
MD542f157ad8e79e06a142791d6e98e0365
SHA1a05e8946e04907af3f631a7de1537d7c1bb34443
SHA256e30402cd45589982489719678adf59b016674faa6f7a9af074601e978cc9a0ed
SHA512e214e1cd49e677e1ed632e86e4d1680b0d04a7a0086a273422c14c28485dc549cc5b4bde13e45336f0c4b842751dfd6ef702df3524bc6570c477a4f713db09dc
-
Filesize
6KB
MD58ec0f0e49ffe092345673ab4d9f45641
SHA1401bd9e2894e9098504f7cc8f8d52f86c3ebe495
SHA25693b9f783b5faed3ecfafbe20dfcf1bee3ce33f66909879cd39ae88c36acbdfac
SHA51260363b36587a3ace9ae1dbc21ffd39f903e5f51945eebdcf0316904eee316c9d711d7a014b28977d54eef25dec13f659aab06325f761d9f3ce9baca3cb12f248
-
Filesize
16KB
MD505206d577ce19c1ef8d9341b93cd5520
SHA11ee5c862592045912eb45f9d94376f47b5410d3d
SHA256e2bbdc7ba4236f9c4cb829d63137fdac3a308fd5da96acea35212beafe01b877
SHA5124648fa7ea0a35a148e9dac1f659601ebf48910ca699ed9ef8d46614c7cbe14fcf47fa30dc87af53b987934a2a56cd71fd0e58182ef36a97ed47bd84637b54855
-
Filesize
561B
MD57ae06a071e39d392c21f8395ef5a9261
SHA1007e618097c9a099c9f5c3129e5bbf1fc7deb930
SHA25600e152629bdbf25a866f98e6fc30626d2514527beef1b76ebb85b1f5f9c83718
SHA5125203c937597e51b97273040fe441392e0df7841f680fcca0d761ac6d47b72d02c8918614f030fbf23d8a58cb5625b702546e4c6f93e130cc5d3b41c154c42655
-
Filesize
10KB
MD5380d15f61b0e775054eefdce7279510d
SHA147285dc55dafd082edd1851eea8edc2f7a1d0157
SHA256bef491a61351ad58cda96b73dba70027fdbe4966917e33145ba5cfa8c83bc717
SHA512d4cbaad29d742d55926fea6b3fa1cf754c3e71736e763d9271dc983e08fce5251fa849d4ecdc1187c29f92e27adab22b8f99791e46302b5d9c2e90b832c28c28
-
Filesize
833B
MD5522cc5c5b1c0f3840523f6b6dcd2aa21
SHA1e5631a8d56074a4be221dfed52095c1eff99bd90
SHA25613542baf6d5bf8abfe3c7b13e5a9e7f977d09ba1379628b483c707102a65a9bf
SHA512bcccb203750984b0592ff51b996ef154747094768cd640388116013b02d90977465aca2727061e5b14d7ff7a88b952dbc2e61fbddbc55a511a232918e263faa2
-
Filesize
1KB
MD52c8070f084ff635f9e016b831cd6ef16
SHA184d8287a21eaf176ebd7b3efe8571b3862de873a
SHA256535d007133ddae112030480aac0b6954d4aac98bcd69b0ef192a010770564a4f
SHA512f7dd550984e579912cf8fa688c53985308862954688b44482c83c05d61274519812a5ea9b6ddcfcd8972d117c8e3edfa6da0e23f3c8ea17ef0bdab80bf0d4c1f
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
192KB
-
Filesize
3.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
216KB
-
Filesize
120KB
-
Filesize
440KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
112KB
-
Filesize
40KB
-
Filesize
1.1MB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
584KB
-
Filesize
5.0MB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB