mercurialgrabber | 0f22d8c34f3ecd40535fe4f88e5b05560a062e7edd97c18c673980f35d5b319f

Analysis

max time kernel
316s
max time network
317s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
05-04-2024 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial Grabber.exe
Size

48KB
MD5

8159bc0b78ff637a9f5b20f05850a9dd
SHA1

a023262d8c60dfaac5f68798d7d9986494b6ca8c
SHA256

496cb15b8bb0d6503b222c301c7cfbbb6d214de32b69b0cd402e6ebaeb2a3a2b
SHA512

49d00b7ce4f46d84b2af17f5e0a886304f012ab26fcac888b7df7be5adbf61f9673d8214e2b0fae7c287302cb2948e42e82eae6ad840c90634e6a4a93d2c15c0
SSDEEP

768:3MsLsY8YVKIEomMTuZiLerxTjgKZKfgm3EhS2F:WLYVbcyLgxTsF7Ew2F

Score

10^/10

mercurialgrabber evasion stealer

Malware Config

Extracted

Family

mercurialgrabber

https://discord.com/api/webhooks/969936040930451487/mf72QATeKW89Ml_jXHm5Gg0GOsTvPdWwtRq38PIRPQd6yxDgKPUPBfyhOYe2g2Z83rsM

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Mercurial Grabber.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Mercurial Grabber.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Mercurial Grabber.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Mercurial Grabber.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Mercurial Grabber.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Mercurial Grabber.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Mercurial Grabber.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	Mercurial Grabber.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Mercurial Grabber.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Mercurial Grabber.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Mercurial Grabber.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	Mercurial Grabber.exe

Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Mercurial Grabber.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Mercurial Grabber.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	Mercurial Grabber.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Mercurial Grabber.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	Mercurial Grabber.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	Mercurial Grabber.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	Mercurial Grabber.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	Mercurial Grabber.exe

C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial Grabber.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:5044

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5044-0-0x0000000000C20000-0x0000000000C30000-memory.dmp

Filesize
64KB

Download
memory/5044-2-0x00007FFE783E0000-0x00007FFE78DCC000-memory.dmp

Filesize
9.9MB

Download
memory/5044-3-0x00007FFE783E0000-0x00007FFE78DCC000-memory.dmp

Filesize
9.9MB

Download