Behavioral task
behavioral1
Sample
178ee7ee223329c599e74ab8fbb4dadf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
178ee7ee223329c599e74ab8fbb4dadf.exe
Resource
win10v2004-20231215-en
General
-
Target
178ee7ee223329c599e74ab8fbb4dadf
-
Size
44KB
-
MD5
178ee7ee223329c599e74ab8fbb4dadf
-
SHA1
0eade7997946fcd1e8a4e583b3522f6a518d4eef
-
SHA256
e11880a04eb88f49e4f41092c4382336f13177d89b90cb076a34e27b1273eeba
-
SHA512
a7af70fdcf08ee1fc870bded335244cead29047117ac6c581314a0bc9e0459c1b7789149fea6c1815c334b823b5f3bbf5d08deffa28a394a660f24f63e829de6
-
SSDEEP
768:aAMF9oxsedD7EPJuI7nrKbTjCFdGf0WBREhXplgFQg5P:yuD7UWT2UnEzlgFrB
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/871668035059073075/gkmIXl2NU_rT1vGbQX1zC-alguEAhJZVJmZKizfBc2ysB15ICEsvWBKk44NCrI_uIByT
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 178ee7ee223329c599e74ab8fbb4dadf
Files
-
178ee7ee223329c599e74ab8fbb4dadf.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ