Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

dae265f15a...eb.exe

windows7-x64

10

dae265f15a...eb.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    21/03/2024, 06:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dae265f15a2f0d9be42a935762334eeb.exe

  • Size

    46KB

  • MD5

    dae265f15a2f0d9be42a935762334eeb

  • SHA1

    f627b044c8a5bfaf9fb3c37990d8d467f592a823

  • SHA256

    63b54beb6c75332e1aba006f25e0f09ca0c7cafcf88eea78369f0a1984d3825c

  • SHA512

    67595f0e01c2aa6d0a3d954bcfd392e5a5ed977e8a4e7823ce72b1051cc2414ce42490c7ffcf34c88ad61c8bb8498ffddf00fb2eb7aea43639af42180a305cc4

  • SSDEEP

    768:OMpdnWyobcMra82j/uZ6LyATj5KZKfgm3EhD9:Ov/oMrc1LyATFF7E59

Score
10/10
mercurialgrabberevasionspywarestealer

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/870971151042621440/s1HnCY32ABGdBxs3bkuRHAInRsgvg9CvCKwlrwKH1-fnLPvP7t0lnaZDSFd5b_xsafpJ

Signatures

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks SCSI registry key(s) 3 TTPs 1 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dae265f15a2f0d9be42a935762334eeb.exe
    "C:\Users\Admin\AppData\Local\Temp\dae265f15a2f0d9be42a935762334eeb.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2924
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2924 -s 1872
      2⤵
        PID:2820

    Network

    • flag-us
      DNS
      ip4.seeip.org
      dae265f15a2f0d9be42a935762334eeb.exe
      Remote address:
      8.8.8.8:53
      Request
      ip4.seeip.org
      IN A
      Response
      ip4.seeip.org
      IN A
      23.128.64.141
    • flag-us
      DNS
      apps.identrust.com
      dae265f15a2f0d9be42a935762334eeb.exe
      Remote address:
      8.8.8.8:53
      Request
      apps.identrust.com
      IN A
      Response
      apps.identrust.com
      IN CNAME
      identrust.edgesuite.net
      identrust.edgesuite.net
      IN CNAME
      a1952.dscq.akamai.net
      a1952.dscq.akamai.net
      IN A
      96.17.179.184
      a1952.dscq.akamai.net
      IN A
      96.17.179.205
    • flag-gb
      GET
      http://apps.identrust.com/roots/dstrootcax3.p7c
      dae265f15a2f0d9be42a935762334eeb.exe
      Remote address:
      96.17.179.184:80
      Request
      GET /roots/dstrootcax3.p7c HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/6.1
      Host: apps.identrust.com
      Response
      HTTP/1.1 200 OK
      X-XSS-Protection: 1; mode=block
      X-Frame-Options: SAMEORIGIN
      X-Content-Type-Options: nosniff
      X-Robots-Tag: noindex
      Referrer-Policy: same-origin
      Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT
      ETag: "37d-6079b8c0929c0"
      Accept-Ranges: bytes
      Content-Length: 893
      X-Content-Type-Options: nosniff
      X-Frame-Options: sameorigin
      Content-Type: application/pkcs7-mime
      Cache-Control: max-age=3600
      Expires: Thu, 21 Mar 2024 07:09:09 GMT
      Date: Thu, 21 Mar 2024 06:09:09 GMT
      Connection: keep-alive
    • flag-us
      DNS
      ip-api.com
      dae265f15a2f0d9be42a935762334eeb.exe
      Remote address:
      8.8.8.8:53
      Request
      ip-api.com
      IN A
      Response
      ip-api.com
      IN A
      208.95.112.1
    • flag-us
      GET
      http://ip-api.com//json/
      dae265f15a2f0d9be42a935762334eeb.exe
      Remote address:
      208.95.112.1:80
      Request
      GET //json/ HTTP/1.1
      Host: ip-api.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Thu, 21 Mar 2024 06:09:09 GMT
      Content-Type: application/json; charset=utf-8
      Content-Length: 313
      Access-Control-Allow-Origin: *
      X-Ttl: 60
      X-Rl: 44
    • flag-us
      DNS
      discord.com
      dae265f15a2f0d9be42a935762334eeb.exe
      Remote address:
      8.8.8.8:53
      Request
      discord.com
      IN A
      Response
      discord.com
      IN A
      162.159.135.232
      discord.com
      IN A
      162.159.137.232
      discord.com
      IN A
      162.159.128.233
      discord.com
      IN A
      162.159.138.232
      discord.com
      IN A
      162.159.136.232
    • 23.128.64.141:443
      ip4.seeip.org
      tls
      dae265f15a2f0d9be42a935762334eeb.exe
      972 B
       4.9kB
       13
      10
    • 96.17.179.184:80
      http://apps.identrust.com/roots/dstrootcax3.p7c
      http
      dae265f15a2f0d9be42a935762334eeb.exe
      323 B
       1.6kB
       4
      4

      HTTP Request

      GET http://apps.identrust.com/roots/dstrootcax3.p7c

      HTTP Response

      200
    • 208.95.112.1:80
      http://ip-api.com//json/
      http
      dae265f15a2f0d9be42a935762334eeb.exe
      296 B
       622 B
       5
      3

      HTTP Request

      GET http://ip-api.com//json/

      HTTP Response

      200
    • 162.159.135.232:443
      discord.com
      tls
      dae265f15a2f0d9be42a935762334eeb.exe
      345 B
       219 B
       5
      5
    • 162.159.135.232:443
      discord.com
      tls
      dae265f15a2f0d9be42a935762334eeb.exe
      345 B
       219 B
       5
      5
    • 8.8.8.8:53
      ip4.seeip.org
      dns
      dae265f15a2f0d9be42a935762334eeb.exe
      59 B
       75 B
       1
      1

      DNS Request

      ip4.seeip.org

      DNS Response

      23.128.64.141

    • 8.8.8.8:53
      apps.identrust.com
      dns
      dae265f15a2f0d9be42a935762334eeb.exe
      64 B
       165 B
       1
      1

      DNS Request

      apps.identrust.com

      DNS Response

      96.17.179.184
      96.17.179.205

    • 8.8.8.8:53
      ip-api.com
      dns
      dae265f15a2f0d9be42a935762334eeb.exe
      56 B
       72 B
       1
      1

      DNS Request

      ip-api.com

      DNS Response

      208.95.112.1

    • 8.8.8.8:53
      discord.com
      dns
      dae265f15a2f0d9be42a935762334eeb.exe
      57 B
       137 B
       1
      1

      DNS Request

      discord.com

      DNS Response

      162.159.135.232
      162.159.137.232
      162.159.128.233
      162.159.138.232
      162.159.136.232

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
      Filesize

      304B

      MD5

      c19066cc297756b09e6830d88582795d

      SHA1

      488a4d05e16d856ca14572bd42ca5630f903c561

      SHA256

      f6c6b89f5d88da32c26a3f65f2013bee7077ed198f0daf42bb5b5bc089a67717

      SHA512

      5e08aa5819952615b528c23e7382aabf2d46e9953a764eca70496cd50aa3d415727d53b1e37c00d3ddf092268cb1a8f4f5dcf7b62b294897d85dc7c5dd79d96c

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Cab3F63.tmp
      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\Tar40B1.tmp
      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

      Download Submit

    • memory/2924-0-0x00000000002F0000-0x0000000000300000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2924-1-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2924-2-0x000000001AFB0000-0x000000001B030000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2924-69-0x000007FEF5390000-0x000007FEF5D7C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2924-70-0x000000001AFB0000-0x000000001B030000-memory.dmp

      Filesize

      512KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.