Behavioral task
behavioral1
Sample
20a92bd3f92fb04d2ca496f872f56aec.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
20a92bd3f92fb04d2ca496f872f56aec.exe
Resource
win10v2004-20231215-en
General
-
Target
20a92bd3f92fb04d2ca496f872f56aec
-
Size
42KB
-
MD5
20a92bd3f92fb04d2ca496f872f56aec
-
SHA1
6037ced904c8b3c85e8e6c53b829ab3845f1ad57
-
SHA256
1e70aaa549dccbdf883663341951d4fb0ca3100d51ecd57103399ecd103a83fa
-
SHA512
b238e16c0371877ad0c028edd667d2900be4d86428de9f5a1beae91a09f7eabb1d3d2e66a42a8e8b9ee391f38bb0f64f014b9826039c378f8c60317e20d45104
-
SSDEEP
768:wzALvnDylOc5uZKLD4TjJKZKfgm3EhvR:FjnD9cLLD4T1F7EtR
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/882420159938175066/EJMvfuhR5-vTOn7rEmYIgvT6pbKf8hXZ58JMj8xwzMuivkhfaC_cNc3t2tKVj1c2WyNu
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20a92bd3f92fb04d2ca496f872f56aec
Files
-
20a92bd3f92fb04d2ca496f872f56aec.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ