Analysis

  • max time kernel
    705s
  • max time network
    1608s
  • platform
    windows10-1703_x64
  • resource
    win10-20230621-en
  • resource tags

    arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/06/2023, 15:52

General

  • Target

    Mercurial.exe

  • Size

    3.2MB

  • MD5

    a9477b3e21018b96fc5d2264d4016e65

  • SHA1

    493fa8da8bf89ea773aeb282215f78219a5401b7

  • SHA256

    890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

  • SHA512

    66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c

  • SSDEEP

    98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07

Score
7/10

Malware Config

Signatures

  • Obfuscated with Agile.Net obfuscator 11 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
    "C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3752
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4500
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:2436

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/3752-120-0x0000000000BD0000-0x0000000000F0A000-memory.dmp

              Filesize

              3.2MB

            • memory/3752-121-0x0000000005EA0000-0x000000000639E000-memory.dmp

              Filesize

              5.0MB

            • memory/3752-122-0x0000000005890000-0x0000000005922000-memory.dmp

              Filesize

              584KB

            • memory/3752-123-0x00000000032B0000-0x00000000032C0000-memory.dmp

              Filesize

              64KB

            • memory/3752-124-0x0000000005880000-0x000000000588A000-memory.dmp

              Filesize

              40KB

            • memory/3752-125-0x0000000005930000-0x000000000594C000-memory.dmp

              Filesize

              112KB

            • memory/3752-126-0x0000000005970000-0x0000000005990000-memory.dmp

              Filesize

              128KB

            • memory/3752-127-0x0000000005A60000-0x0000000005A80000-memory.dmp

              Filesize

              128KB

            • memory/3752-128-0x0000000005A80000-0x0000000005A90000-memory.dmp

              Filesize

              64KB

            • memory/3752-129-0x0000000005B30000-0x0000000005B44000-memory.dmp

              Filesize

              80KB

            • memory/3752-130-0x0000000005B40000-0x0000000005BAE000-memory.dmp

              Filesize

              440KB

            • memory/3752-131-0x0000000005BC0000-0x0000000005BDE000-memory.dmp

              Filesize

              120KB

            • memory/3752-132-0x0000000005BF0000-0x0000000005C26000-memory.dmp

              Filesize

              216KB

            • memory/3752-133-0x0000000005C40000-0x0000000005C4E000-memory.dmp

              Filesize

              56KB

            • memory/3752-134-0x0000000005C50000-0x0000000005C5E000-memory.dmp

              Filesize

              56KB

            • memory/3752-135-0x00000000064A0000-0x00000000065EA000-memory.dmp

              Filesize

              1.3MB

            • memory/3752-136-0x00000000066C0000-0x00000000067D6000-memory.dmp

              Filesize

              1.1MB

            • memory/3752-137-0x0000000005DE0000-0x0000000005E10000-memory.dmp

              Filesize

              192KB

            • memory/3752-138-0x0000000009210000-0x0000000009218000-memory.dmp

              Filesize

              32KB

            • memory/3752-139-0x00000000032B0000-0x00000000032C0000-memory.dmp

              Filesize

              64KB

            • memory/3752-140-0x00000000032B0000-0x00000000032C0000-memory.dmp

              Filesize

              64KB

            • memory/3752-141-0x00000000032B0000-0x00000000032C0000-memory.dmp

              Filesize

              64KB

            • memory/3752-142-0x00000000032B0000-0x00000000032C0000-memory.dmp

              Filesize

              64KB