Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/p...

windows10-2004-x64

10

Analysis

  • max time kernel
    97s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/04/2023, 16:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://github.com/pleasekys/Synapse-X-Cracked/raw/main/Synapse%20X%20Setup.exe
  • Sample230420-tf3cssch4x
Score
10/10
mercurialgrabberevasionspywarestealer

Malware Config

Extracted

Family

  • mercurialgrabber

C2

  • https://discord.com/api/webhooks/887794472006594630/40jMuLtacrKwzDl4LHqrbDNYJRBU5rsrWfPQj_fKoK9VEct6IcF913EXDwWcGQatPxaJ

Signatures

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 1 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 29 IoCs
    adwarespyware
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/pleasekys/Synapse-X-Cracked/raw/main/Synapse%20X%20Setup.exe
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3160 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3048
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\Synapse X Setup.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\Synapse X Setup.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:4216
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4216 -s 2200
        3⤵
        • Program crash
        PID:4768
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 440 -p 4216 -ip 4216
    1⤵
      PID:4816

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          69C6F6EC64E114822DF688DC12CDD86C
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C
          • Size 779B
          • SHA256 61dacf2b7fbc5bd2909d96c7ed13b55e2a0521e0f0a90b7872c739611253a380
          • MD5 SHA1 SHA512
          Submit Download

          69C6F6EC64E114822DF688DC12CDD86C
          • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C
          • Size 246B
          • SHA256 1909b378ae0c8f88c1b0e1bb9080551ee0ecf07b486f14f89d1dffe57b0f88a0
          • MD5 SHA1 SHA512
          Submit Download

          Synapse X Setup.exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\Synapse X Setup.exe
          • Size 153KB
          • SHA256 52b547ee6c94c7b64bca6b264763371bce262ef9cc09f0ec0d0f223457d3097c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Synapse X Setup.exe.bxz6snu.partial
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\Synapse X Setup.exe.bxz6snu.partial
          • Size 153KB
          • SHA256 52b547ee6c94c7b64bca6b264763371bce262ef9cc09f0ec0d0f223457d3097c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Synapse%20X%20Setup[1].exe
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\Synapse%20X%20Setup[1].exe
          • Size 153KB
          • SHA256 52b547ee6c94c7b64bca6b264763371bce262ef9cc09f0ec0d0f223457d3097c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          suggestions[1].en-US
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\suggestions[1].en-US
          • Size 17KB
          • SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/4216-151-0x00000000000B0000-0x00000000000DC000-memory.dmp
          Download

          memory/4216-152-0x000000001C2F0000-0x000000001C300000-memory.dmp
          Download