Analysis

  • max time kernel
    120s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    14-09-2023 06:03

General

  • Target

    output.exe

  • Size

    41KB

  • MD5

    4f44a74b82f5b05dfe9474538009c0b6

  • SHA1

    b274532d0a88ba4b49cf6e4f08b3074aa3eb8ee1

  • SHA256

    48c7a3baf593016604a12523991918dde59315ec4bffe694cd439c1c8f53b049

  • SHA512

    2bbdea4451ae1916986596c12e05266bd3c48308759a296906339f40ad4dfffda8d875c03aa0bfbef53c95054540415b55fd4a9be0437d74e1649b29e76f7f46

  • SSDEEP

    768:pscoSf3GMXfT6axpDXswguZkeTWTjxKZKfgm3EhZq:2coSfnxEeTWTlF7EPq

Malware Config

Signatures

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 1 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\output.exe
    "C:\Users\Admin\AppData\Local\Temp\output.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1084 -s 1768
      2⤵
      • Program crash
      PID:1992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bc27ae380f9b2bb6cbfddcd0dbd12853

    SHA1

    19d7f7a6746bfc15286b19a97751a730fd4b902e

    SHA256

    f19ab22ab8672d6e05485d9deb934884f2b494a08768d49ee4de1b1cd42b75a7

    SHA512

    02b7c90a765cb20fe1033b904ebd46881767311ba11a73c772a3354278fcd18bcb17833f26f5050f42b07f8525c7601eee8879859fc72a22040aef1c11b24531

  • C:\Users\Admin\AppData\Local\Temp\Cab34F7.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar35A6.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • memory/1084-0-0x0000000001360000-0x0000000001370000-memory.dmp

    Filesize

    64KB

  • memory/1084-1-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

    Filesize

    9.9MB

  • memory/1084-2-0x0000000000B60000-0x0000000000BE0000-memory.dmp

    Filesize

    512KB

  • memory/1084-82-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

    Filesize

    9.9MB

  • memory/1084-83-0x0000000000B60000-0x0000000000BE0000-memory.dmp

    Filesize

    512KB