Analysis
-
max time kernel
149s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2023 15:51
Behavioral task
behavioral1
Sample
FortFire_V6.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
FortFire_V6.exe
Resource
win10v2004-20231130-en
General
-
Target
FortFire_V6.exe
-
Size
306KB
-
MD5
06adcf99da75a5a0441217993686f2b8
-
SHA1
9028f5197b15fd3c047703a77888afb6969ed462
-
SHA256
27215c86d52acc289f22159da5aa094fe57ffd92b4ecd50e8364ce7e413f7948
-
SHA512
919333a2545a2a4c6a2e6a6bf6f065d167fccfda71224febeb85c472f8f57b882440d7526a4726066f825c1ae46204a5e1a995e1458c2d9b32e2d5cd9699ed77
-
SSDEEP
768:YdXCfT4lMmkDgmpjuZmL6M/TjfKZKfgm3EhNDp7qwEFIZJxfx7uRT:YwTASpLL6M/TjF7EvDl6IZ75i
Malware Config
Extracted
mercurialgrabber
https://canary.discord.com/api/webhooks/1171148657458958417/b4eXbtxR2mg7kdanZqAf670H2pdhuCNlUO-CliCgpEeixMJqY7nW67Iqy6ZP1CwQcP9u
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
FortFire_V6.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions FortFire_V6.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
FortFire_V6.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools FortFire_V6.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
FortFire_V6.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FortFire_V6.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip4.seeip.org 8 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
FortFire_V6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum FortFire_V6.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 FortFire_V6.exe -
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exeFortFire_V6.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S FortFire_V6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
FortFire_V6.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FortFire_V6.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 FortFire_V6.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
FortFire_V6.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName FortFire_V6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 FortFire_V6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation FortFire_V6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer FortFire_V6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1164 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
FortFire_V6.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 3252 FortFire_V6.exe Token: SeDebugPrivilege 1164 taskmgr.exe Token: SeSystemProfilePrivilege 1164 taskmgr.exe Token: SeCreateGlobalPrivilege 1164 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe 1164 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortFire_V6.exe"C:\Users\Admin\AppData\Local\Temp\FortFire_V6.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1164