46604cb79716d7402b03cf68c6aa353d1c560d750bc82a1b4d549309a4d58ff4

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-03-2024 01:08

Target

Email-Worm/Merkur.exe
Size

44KB
MD5

e6f8f701d646b193139cf0a92229455f
SHA1

b7747d41fcf52c3611af1153e46183dacbb3c709
SHA256

7e89fabfdbe214bf6a6f9730f3e451e69f752b62bbd54c0a81d2aae2320abd2c
SHA512

135d69ed4b3acdeaf45639090cefd48fa02f9ff1fb168d249717d0e2d3295530b697d8ff3fea84fa20a66aeb99437e5b0f2a2c3936f2a109c1068816263003ae
SSDEEP

384:/T16PQm7lU7lnDSLOwglunEuMhlkW3YpCzkVei7kVrcwh8PDM9TkLJI4WvEfbqgJ:/hdmCJq1glWlOEDvEo2k/2w/mo

Score

5^/10

Drops file in System32 directory 1 IoCs

Processes:

Merkur.exe

description ioc process

File created \??\c:\Windows\SysWOW64\regme.reg Merkur.exe

description	ioc	process
File created	\??\c:\Windows\SysWOW64\regme.reg	Merkur.exe

Drops file in Program Files directory 7 IoCs

Processes:

Merkur.exe

description	ioc	process
File created	\??\c:\program files\bearshare\shared\Virtual Sex Simulator.exe	Merkur.exe
File created	\??\c:\program files\eDonkey2000\incoming\Virtual Sex Simulator.exe	Merkur.exe
File created	\??\c:\Program Files\mIRC\script.ini	Merkur.exe
File created	\??\c:\program files\eDonkey2000\incoming\IPspoofer.exe	Merkur.exe
File created	\??\c:\program files\kazaa\my shared folder\IPspoofer.exe	Merkur.exe
File created	\??\c:\program files\bearshare\shared\IPspoofer.exe	Merkur.exe
File created	\??\c:\program files\kazaa\my shared folder\Virtual Sex Simulator.exe	Merkur.exe

Drops file in Windows directory 7 IoCs

Processes:

Merkur.exe

description	ioc	process
File opened for modification	\??\c:\windows\screensaver.exe	Merkur.exe
File created	\??\c:\WINDOWS\taskman.exe	Merkur.exe
File opened for modification	\??\c:\WINDOWS\taskman.exe	Merkur.exe
File created	\??\c:\Windows\System\AVupdate.exe	Merkur.exe
File opened for modification	\??\c:\Windows\System\AVupdate.exe	Merkur.exe
File created	\??\c:\Windows\Notepad.exe	Merkur.exe
File created	\??\c:\windows\screensaver.exe	Merkur.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3328 regedit.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Merkur.exe

pid process

2948 Merkur.exe

pid	process
3328	regedit.exe

pid	process
2948	Merkur.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Merkur.exe

description	pid	process	target process
PID 2948 wrote to memory of 3328	2948	Merkur.exe	regedit.exe
PID 2948 wrote to memory of 3328	2948	Merkur.exe	regedit.exe
PID 2948 wrote to memory of 3328	2948	Merkur.exe	regedit.exe
PID 2948 wrote to memory of 4500	2948	Merkur.exe	cmd.exe
PID 2948 wrote to memory of 4500	2948	Merkur.exe	cmd.exe
PID 2948 wrote to memory of 4500	2948	Merkur.exe	cmd.exe

C:\Windows\SysWOW64\regedit.exe
regedit /s c:\Windows\system32\regme.reg
2⤵
- Runs .reg file with regedit
PID:3328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\pr0n.bat
2⤵
PID:4500

C:\Windows\System\AVupdate.exe
Filesize
44KB

MD5
e6f8f701d646b193139cf0a92229455f

SHA1
b7747d41fcf52c3611af1153e46183dacbb3c709

SHA256
7e89fabfdbe214bf6a6f9730f3e451e69f752b62bbd54c0a81d2aae2320abd2c

SHA512
135d69ed4b3acdeaf45639090cefd48fa02f9ff1fb168d249717d0e2d3295530b697d8ff3fea84fa20a66aeb99437e5b0f2a2c3936f2a109c1068816263003ae

Download Submit
\??\c:\Windows\SysWOW64\regme.reg
Filesize
126B

MD5
1065f6f41c70e40297555b6d1878e823

SHA1
18b6b3b6da306b12c7b1f197d6242d2f66703023

SHA256
ab59535ddcea09a82c549ab4f72e0459cc57e41f5b887c42afde0a1dc1ae9947

SHA512
25aac67f601ad21878bd0c92bec8e68433dbdb05621f74d5d23c0b0db1960313e695ce6082abaa82e7ab922323e1fbdd0f9a484ae2cf01abecf431cb4bee5ea8

Download Submit