Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
-
submitted
10-04-2024 19:41
General
-
Target
Boris FX Saphire AE v19.6.28.exe
-
Size
203KB
-
MD5
21ce2adbe9c4ce28ac6b046ab37b410b
-
SHA1
d71ce74e347fdab8dcdafd4d23d403dbcc9c1be6
-
SHA256
c0289e36b3d5943c54c837d7b86e8bb5438413a503def4b12924eb0cf9ebaa14
-
SHA512
e8917c5c4b441bad9f6af5f5cc3cf31a0390972b9638785dc5e919f640b45c46e5dc5b5a13cfece1486c4d8eba82b4f7e39f445da620140694c7a0b460df91f5
-
SSDEEP
768:S8SXYLv+qylOcnuZwLEK1TjDKZKfgm3EhBWvsl7hj6SC:vPj+q9cDLEkTfF7E/WK7hHC
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1227702584115068959/XgeCFaD-3U7ddCVAnmrQPhTSrGgLYI_4tDJg864KEaNRJCAOV3hCE0qV8RoopEu1TPn0
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Boris FX Saphire AE v19.6.28.exe"C:\Users\Admin\AppData\Local\Temp\Boris FX Saphire AE v19.6.28.exe"1⤵
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB