Analysis

  • max time kernel
    74s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-07-2023 02:48

General

  • Target

    https://mega.nz/file/PB5FVCoY#9sUOD9DKADKD03yWUAhwTTPaHOUra-0PcgPk6UrbDsU

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1132852812175388723/EMb_ZCFWhDDAMngDie1NDmKQz2SdCXX8YEh8zLxl-8EeVWfa7Gkysu29DoeFRDFM22cx

Signatures

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks SCSI registry key(s) 3 TTPs 1 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 7 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mega.nz/file/PB5FVCoY#9sUOD9DKADKD03yWUAhwTTPaHOUra-0PcgPk6UrbDsU
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:920
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc05219758,0x7ffc05219768,0x7ffc05219778
      2⤵
        PID:2864
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:2
        2⤵
          PID:2300
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
          2⤵
            PID:1432
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
            2⤵
              PID:5036
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:1
              2⤵
                PID:4488
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:1
                2⤵
                  PID:1984
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
                  2⤵
                    PID:4152
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
                    2⤵
                      PID:4408
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5180 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
                      2⤵
                        PID:3408
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
                        2⤵
                          PID:4420
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
                          2⤵
                            PID:1812
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 --field-trial-handle=1884,i,12257747404317138029,351516200284319967,131072 /prefetch:8
                            2⤵
                              PID:2132
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:1560
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x4f0 0x4ec
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2392
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:4012
                              • C:\Users\Admin\Desktop\Image grabber 2K23.exe
                                "C:\Users\Admin\Desktop\Image grabber 2K23.exe"
                                1⤵
                                • Looks for VirtualBox Guest Additions in registry
                                • Looks for VMWare Tools registry key
                                • Checks BIOS information in registry
                                • Maps connected drives based on registry
                                • Checks SCSI registry key(s)
                                • Checks processor information in registry
                                • Enumerates system info in registry
                                PID:2984

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                72B

                                MD5

                                5335d0aa6da345b4605638ccf59fbcdb

                                SHA1

                                eb0741da290cb03a39501793b1a20a070263fdb0

                                SHA256

                                c13e39c8375ce54588a8291d8de94cf53320c28560e22046008e3aa6fc6a6daa

                                SHA512

                                69c66497d5491ea3757663d1ebac85a984a8083864f8079f49ab970b1a8b568a4f0860a71d9cb3fe62df18e9e35afd829f10e600d446f29cae48c72a40290da7

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001

                                Filesize

                                41B

                                MD5

                                5af87dfd673ba2115e2fcf5cfdb727ab

                                SHA1

                                d5b5bbf396dc291274584ef71f444f420b6056f1

                                SHA256

                                f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                SHA512

                                de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                23243b9cd3c6308304714e65d1b29c27

                                SHA1

                                32bbccba5fcfccec906bf38bff5c68cdf2e1b8a1

                                SHA256

                                3a76fe168892b4c5e6f926d3d0d1475dc309d97c81ab5b32fd59ef951eb9bcd7

                                SHA512

                                eb1e6edef888ac71341396df71453abca5fa68b816a2088c2642ebaa1ce120d476378da3ef09c78a0b6ab06d9dada0a281f2f3baf2eeddeeff93e25b5a556337

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                538B

                                MD5

                                894630af4fee448611b87f632eca779a

                                SHA1

                                cf8b6283d5d15907a7648e2c15a99ba9b0aa36c7

                                SHA256

                                9df11b605cd0f25ef8508bb4f884bf886c439369f56ee8ecd3688f11839618a3

                                SHA512

                                ff682dc32d9397908b1271d2c227c133dede7272df446282ec4914352352fbf0a95c3d97feb9fb9c15abeb88b0268f26a7419a97a8158983a411de913bb40cfb

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                5a3417e3222d1a7913c2e36841d6718a

                                SHA1

                                1dd85c32c3e19b115bf6b01eb1bfdb2dda1ac58f

                                SHA256

                                d48d231baf44f325cff1cd199456addd9bf41d513a2f099c7c11e7bb53b55224

                                SHA512

                                f56699225bcae5bddb7eef1b53babae49f82bb746578d482feb02ab92f03d14ab777296cb222e28614f0722fdf50601d5018e100724ba54a20be5cbd22aa0b58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                4c8d33a4726b75e645a5d3d24cb3cb2b

                                SHA1

                                e9c8139d1651592362428a998f57bae185c41f13

                                SHA256

                                a6f0b095e685a8832ff46ea3763eced6b1ae772adb503817dcca822a4744849c

                                SHA512

                                b591a886d236988c830e5596ff6597e89bc7d172a4b51a382f58172e66a64c5437fb07b7c162c82d82b616546e39ed30a8b8f9320aca3ea4764392aca768f56c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                b12b6b9b8e7ddd7705e41a15de7c2c30

                                SHA1

                                d7afd487a766eb5e357a8ee50d5327dedc1f1750

                                SHA256

                                15ef97de0a8b3e62d3c2944e21bee40356c71ad9cc7783828de6fcf281a0161e

                                SHA512

                                8d92314cd96bc43122776cfaf0229178c4ed6c15269efd114e717dd7c81741c80492b1875d4919578126666721fcfd4e9757142e4869b98a18edcc500436a90f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

                                Filesize

                                16B

                                MD5

                                46295cac801e5d4857d09837238a6394

                                SHA1

                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                SHA256

                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                SHA512

                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                Filesize

                                72B

                                MD5

                                36d463290a94f9398b6a587e43ab3c69

                                SHA1

                                25351b8e647b27a93248f3f690786e9e51f5a17d

                                SHA256

                                d190e51de7023d9c69a5e8b233fdd6ec3e5b63da255ee054b45f169a1d54e8b8

                                SHA512

                                49f073ea2b318595a1a7c153e8803d001bf9a99708f7c6910263763dd2c04a0fe1d452514ae3f16e66c7c7321b60f64576614de781d3179617b392850c066626

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57cf27.TMP

                                Filesize

                                48B

                                MD5

                                1b274248d1627b728402bd0ef10f74a9

                                SHA1

                                8ebf0a43083746b47b89014273c575f246ab0875

                                SHA256

                                4d32f76a8c4c751c9aa99880b9b6c414bfb2621da263dfe4387c228cc76f05d8

                                SHA512

                                e165d74f817232baead40930410f4955d65e665921386e5e91a5fcf2908cf39b672265a476224fc5be66fd320891a03eee65878a6ee0e3f39089840b1957dd09

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                87KB

                                MD5

                                c4db8a029e2e44233ea98a9457199e02

                                SHA1

                                c55d83b9dd4e6ffec7b972e960c85aa98bcd0ca5

                                SHA256

                                b50c4c1d6a80e67e1c0966689608cd932c61649c4d598a61e4767074e57e1156

                                SHA512

                                f757c6cda58e486aebf9a8fd4629716000b59a6089721a9320c7dd3a940c9d93c26de46137458b374a25e7f0f588604e7925d14d8d589a410862b46961f3d7ac

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                Filesize

                                107KB

                                MD5

                                cf7d4946a2287c7d021b910a7bd15505

                                SHA1

                                e00b9acbac6668e445342018fcc14cfa68a77732

                                SHA256

                                45d4400bf588185cdbb9020e21e5c859e52d35fdf16d213f30008f47729f8fa6

                                SHA512

                                d4346b1ff7c67915bb657c8e3584abdd59b017bc096d30ce7179c4277c2d8a760af264e160298d5fa1e95b22e25d1762113771aa4ab3712a8876dbed1542e8bd

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                Filesize

                                110KB

                                MD5

                                bb66bb9c3a92bd6f725099e5818fe25c

                                SHA1

                                f081042f17f5385483193cdbfca84329de2d03ff

                                SHA256

                                65db5f339ce249603178665bbbd77af0a144d608921fa7269ab2dd67a75228ea

                                SHA512

                                4c8cf8fcda44339a4fabf585ff3fb60ef3ecc8aec51c939ec51712a2ec2f8c81bf741d14494e489438794b2a84d4e7e2e15944b5c4a3978a6b1926107ecdc84a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5812d7.TMP

                                Filesize

                                101KB

                                MD5

                                cd633a37e15209a1e4f4e9bc3921cf04

                                SHA1

                                a94757ed6d85859c23c1b2119d86aea07a6b76c2

                                SHA256

                                66202196d666bb3c870dc85ddcd098864490ae8182114702642c7d166780e52e

                                SHA512

                                230cba86abe837f34c7a4acd2048ddffa7e3b51f18b74b70f939c18ef4c433675b49cd1507da23629ce8dafa71f04697de3b49276e65ab8b9ecdb408c94d6fa8

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                              • C:\Users\Admin\Downloads\RUN AS ADMIN PLEASE.zip

                                Filesize

                                28KB

                                MD5

                                98aa2b5e69f2a57f80bed2060883f8c0

                                SHA1

                                99650bb508c3c2ba788f1a2ab264722eb03f9320

                                SHA256

                                51199077a14ee5a3ff49c56cc80d20cd05e94d903137bb4029f3d9bc5cc90712

                                SHA512

                                3807b0d7be2119754c17fc4fa35c929dedd370bb4d1e856d84571415f1d2efcf57eb8c90120a19de32ee34e371d02d2455ab4ac21a0f708657b5e154a24db882

                              • \??\pipe\crashpad_920_AXIGKRZQBGKDIQSS

                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              • memory/2984-377-0x0000000000B60000-0x0000000000B72000-memory.dmp

                                Filesize

                                72KB

                              • memory/2984-378-0x00007FFBF0690000-0x00007FFBF1151000-memory.dmp

                                Filesize

                                10.8MB

                              • memory/2984-379-0x000000001B8B0000-0x000000001B8C0000-memory.dmp

                                Filesize

                                64KB

                              • memory/2984-383-0x00007FFBF0690000-0x00007FFBF1151000-memory.dmp

                                Filesize

                                10.8MB