Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2023 15:23

General

  • Target

    d69b59702a81b47ec18daef03edbf4b2.exe

  • Size

    41KB

  • MD5

    d69b59702a81b47ec18daef03edbf4b2

  • SHA1

    e49628015124c1d8e8550131e738e0367060cba7

  • SHA256

    8bd44415728c6702c9d736a3c15fa089a6093574e1750443df16d6f0b9ed6f80

  • SHA512

    62e400f6808d77ee312de39edbb9e517d5491a198ec52ab65f7a6b07b13ab96fd62d0d5dcbaf584da3f5a5d2abd6d41586f60ebb3d676ec0d872e8a8cc445bb0

  • SSDEEP

    768:Vo15ehBZ6an8z5pDtsmuZ2L2xTjxKZKfgm3EhCp:D1n8z5PsOL2xTlF7EQp

Malware Config

Signatures

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks SCSI registry key(s) 3 TTPs 1 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d69b59702a81b47ec18daef03edbf4b2.exe
    "C:\Users\Admin\AppData\Local\Temp\d69b59702a81b47ec18daef03edbf4b2.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2964 -s 1904
      2⤵
        PID:1868

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6dbd262b14cd4fcd1ebfd23012c9c801

      SHA1

      4cca8f54cede17cbbccf4de6f8e237e3c99b789b

      SHA256

      dec58670f01caa01d3c92bb710f24fc0a7c1955bae7450e9a16a10c7d49e8f7d

      SHA512

      7865ed2ac73fce5bdf8da0de9c5a94f4083e11a9aa10509b7efb970415eba222514f6523423d59e20cbebe0f06cd10d1262a10d812010e685267ddd0af545e9f

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      7224a341d401e57948531b15f1bb22ac

      SHA1

      a6dabf662edeb805ab53979b2d4b9f3d89762da3

      SHA256

      d6f920a0b8c2316f67e70972137cb78d060482bef9193b4c06a8d6ed09228c17

      SHA512

      1ea08fef37b1ed36b896ccb23f78469b189aa636ed58e2c4fd7eedaccbd90243c935e46848049ecaf4f0dd8835251b504ed37c39b812ab554cd91bab1a943184

    • C:\Users\Admin\AppData\Local\Temp\Tar16C1.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • memory/2964-0-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

      Filesize

      64KB

    • memory/2964-1-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2964-2-0x0000000000B40000-0x0000000000BC0000-memory.dmp

      Filesize

      512KB

    • memory/2964-89-0x000007FEF58C0000-0x000007FEF62AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2964-90-0x0000000000B40000-0x0000000000BC0000-memory.dmp

      Filesize

      512KB