�5��1�)#p���k[#:���~Z��_����!���e�s���ܕ��r����#��� ��9���sR�R�9��S��Ј�q#81D�&X,k�~1m�IJwn��=�6��S��6}��V��3�ƽQ��m����L�Rǎ����R2~0��r��� � 0�L"'A:�!B��?$}%t:�� ]d�i�0#xN�z�X�\���d�ZgH�Z0{O@9� vb@��T�7c�����V��G"�0?��2�*q�� �(Ψ/��Q�֪�զk�K�v5Qn`꫁��B�s�],V���D�D��l�)Έnp��ti)`�H�ƍ�:�@tP�f���~��� k?5m� �s`�W����=&E=+��ˊ���qjӚ:Hi�+zTo���12�q�>�fbS (�a��b!��Y�0�;�&�!���*Y+Ŵ��\��6_y�7�qwĩ|�V�r�,�,����Q�k��%N�\�;)��9B��!`���������(�q. $���S�P�q��8N�眦��(��93 �F��ٛÉ��;��!������}!�,� ��Kp� Za'����/+F�\�^�Er������cL7�1�� ���G���ѵ} �Y�i��ذ����<' �Y-i�A���Q���u.����f:���h^���n��qaB�u��I^�4(��98G��D�cO�����}|�Ia�i})/��Q�!0^ �'�D�h�+���7 ��vRt��=��q7�� 0h\�sѷXФ�_��ު� f�������JqJ�6_H�hۓ�(��b���R�k��m�|Ъ�%��gޢ�C4/V��ù���A�W��l�.^���ӯ,���1�*��`[��.�;p�&��� x�E@b��w�� g�p<�ʎLJ1�Ep�*Ԟm}���wfb�m��kmCq�Ԙ#g7�;6>n�:ey�[ǚ�We��S�����܋�`����(�G�|^�Đ�t�i��q;Cθ�WЈ�4�! cC�?ʩ:J���"��V�ֈt;�� lB����~��>�5s�g ��Μ�S�-��F��`�(�?��M5j�^ºX�l4��[�=L��g���� *�Kxӡ����� Ӌ8��2|�G�W0�@�@�")�<J��wv�`�3�h�.�:��ïy�����$�?�5E�bp���sE�%��R�F��q��s�PB��r^���aYr������M��M���kE��ݐakwJK�Z��AL(��>e���PHIjF�+J����%A1b �xݒmY=��A�&W�� h�R��q;r5��"�at���7½-��q;�)�.�7}$�s�V���\���B����N�oR����gN��_S>�l�������t"%�b�-�I�+������u��o�J��cI>��J�b�hM����/��L�\dJDdv� Dm� �0)��e��ep�II�k*��� @�7��WN[4`c-ص�`! �E��序1p���`- MY<���KH�s�+��ZcS�:��X��^A��#Z���E�>����wC�����.6=�yg �BB�GP�%���d�d]� #e�B��{�*��DH[]a� �ı�X�({boA���eW�X��šEK� R��G�ӿ���ΰ)�'��PA�$��Ȍۖ)�c�`�qN��X�eA�o�6E�w���Ѽ����:T��4���g�O���ڷ�@ˀw���Q�;���p<��Lvsl�pe�����cU�@!W=ʻm?ìӿU�x��@��Q0R�-ݫ��Y8,�# ��l�_����H����Ӫ��S.�zLo����2�*tTN����n� =��������X1a�R�lg�z�G���c-��@�n~����#ָ��2�6йn�*���+��XD�L�F��=)b^��%e#�S�4���3��9� 5�#���0��m�E�4�� �<"ݞ�uS3c��� !�`Y�{��E�6�<�mŘ�ɷ��j�Q�P�)R|c��c<�\ʎsF�Т���W1�C�w��Ӏ�qJA�4.A�F�*� ���$.Z������-+��¨4�Dz�w���żgص�{ek������'��=qBI� x,VG�!u�8$�4�I��[��郄<5�o ��Y�50$���/�����D���7��4c�ۺ�7�tu^�n��-���/%���F�,�J!���̷��'M�"����K��<�I`e-�]ּl����Q���Gs)����VH�f�;�`�48��]��O�h��� QR���9�}o����E��:��� �{���t�W#Q�`���TN��`<kI��wՁ5���༺�˷�M�E��`j���`M�2<gݓ��� �0���{��$�#,ݔ�"�r�`�S,[G֖�g1iD�RӶ>y���#g��cbR)���_䨝 9����M_\N5�^ȈΕ���V�x*���ㅪ,���!u� =�J�3��D�#K4Կe9�2SW��H����48�e_9�>��Y_�/����,&��6T��5�����0� �7n�d���7��H�e"�Lbw��x�Cv+�$[��J�������e&��Ɔſ�YSâf�K�Vw�4���:)��3�RȀ����7J�[;�$��YÞ���Q���(c ui����܌���#~v!v�m�S%�[`=F�|ֵ�2�!QE g�����Ɵ]B�d�5��l�*C�ޛ +���^����;��5i ����<?^�j�Sia� żKKkD6w�3�J�Aد����R<�Z�8��sniuL8�x�������rW��P6��y���, �LU�K��2ȡ'rw�I��ķ���e���P`g�P�/�� ���!Tk����� ��A�����Q=��:���y�8+����G6*�w�;�W7�|p'���6����U����Ii����MkN��a6]��ы_D������D�-Nr�AXO�Z��ȯ.>g�E�9w����_o* ԏގd/�w���Q+]g��d�o��.�U�9�v���*���?�O��=W����&Q�[�y�Q�ma���3!���Z� �b=#�����w�~N\����d�8���b�n�o<�ܜ�|kyܔ�)\��p�y�������kp�D�����_Kb蘩�J�Or� ,��t��`3�}��d�.��O����=���8&�hAQ-�3��`�:�+�hE�O�ۙ�FD��1�=~f�%@)�� ;��o����ҷ!�q<��x�`�!aut��������r�����������ה�OǖwG��F�yX\J��ڜ|��a�e ��װ g�v���o�V����rƲMTX������Aq�I~��~vK;NE�?��:�p�B��� �t\ #T��%�%�1�|%w9���s�]�z����y� Ӧ��~�h�u��O��'�y��b·�y6}~�BL���Ƿ�"�^>�_�K��ܷ����;0{�zz�N�����ܵ��m��۠Qh��T7�ؐ`���IdF�%g��� �N�?(������c��9d��*҄�#F�Ӱ��u~Uo��N_6�|��۾��OI&��D���J�r�w���;oڈ��:��B�.O>k>[���8�~���Bi�wtU1�t��-���3��[���]������94�|�{�� nS�`W-v(
Static task
static1
Behavioral task
behavioral1
Sample
Mercury.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Mercury.exe
Resource
win10v2004-20230915-en
General
-
Target
Mercury.exe
-
Size
3.3MB
-
MD5
797bc73ce22100289209b585a7da286a
-
SHA1
0bd5ac75097131d0e4f860b3faf44bc2d9e149b5
-
SHA256
cc0f3678187086b2db06d11d0c5bfb5a20e5b2501f650b30214dad568102f91d
-
SHA512
954940f5bfde15b549c8bfee81dc22edbf8bc9bc4cb88fc8ff6e0bdb514a91eada849c8f00bead066e9524c52927775e1a3c26371330d54423fd1a8aef79187a
-
SSDEEP
98304:rYxijNrciJZpEblbyd58yNT0sqmR1frp0d9AFdL:XNrOlekysmR1fa7odL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Mercury.exe
Files
-
Mercury.exe.exe windows:6 windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 267KB - Virtual size: 556KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE