Analysis
-
max time kernel
362s -
max time network
388s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27-04-2024 16:12
Static task
static1
Behavioral task
behavioral1
Sample
Mercurial.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Mercurial.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Mercurial.exe
Resource
win11-20240426-en
General
-
Target
Mercurial.exe
-
Size
3.2MB
-
MD5
a9477b3e21018b96fc5d2264d4016e65
-
SHA1
493fa8da8bf89ea773aeb282215f78219a5401b7
-
SHA256
890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
-
SHA512
66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
-
SSDEEP
98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/224-6-0x00000000055D0000-0x00000000055EC000-memory.dmp agile_net behavioral1/memory/224-7-0x0000000005780000-0x00000000057A0000-memory.dmp agile_net behavioral1/memory/224-8-0x00000000057B0000-0x00000000057D0000-memory.dmp agile_net behavioral1/memory/224-9-0x00000000057D0000-0x00000000057E0000-memory.dmp agile_net behavioral1/memory/224-10-0x0000000005800000-0x0000000005814000-memory.dmp agile_net behavioral1/memory/224-11-0x0000000005870000-0x00000000058DE000-memory.dmp agile_net behavioral1/memory/224-15-0x0000000005930000-0x000000000593E000-memory.dmp agile_net behavioral1/memory/224-14-0x0000000005920000-0x000000000592E000-memory.dmp agile_net behavioral1/memory/224-13-0x00000000058E0000-0x0000000005916000-memory.dmp agile_net behavioral1/memory/224-12-0x0000000005820000-0x000000000583E000-memory.dmp agile_net behavioral1/memory/224-16-0x0000000005B90000-0x0000000005CDA000-memory.dmp agile_net -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
Mercurial.exepid process 224 Mercurial.exe 224 Mercurial.exe 224 Mercurial.exe 224 Mercurial.exe 224 Mercurial.exe 224 Mercurial.exe 224 Mercurial.exe 224 Mercurial.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Mercurial.exedescription pid process Token: SeDebugPrivilege 224 Mercurial.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Mercurial.exepid process 224 Mercurial.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Mercurial.execsc.exedescription pid process target process PID 224 wrote to memory of 1552 224 Mercurial.exe csc.exe PID 224 wrote to memory of 1552 224 Mercurial.exe csc.exe PID 224 wrote to memory of 1552 224 Mercurial.exe csc.exe PID 1552 wrote to memory of 1768 1552 csc.exe cvtres.exe PID 1552 wrote to memory of 1768 1552 csc.exe cvtres.exe PID 1552 wrote to memory of 1768 1552 csc.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFEB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE2CBE6F9B7A440B384FDD669DD464CA2.TMP"3⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RESFFEB.tmpFilesize
1KB
MD56e0f5a43658d529a9e9281132cbb0913
SHA1b1177195dbef6a4442372e43e24de1f7c9577425
SHA256e91db040298cb07a93234c3cfaac0c98e63de65f27817e25bc1d4da0239876d1
SHA512e497acacf331df47f86afddb397ba5049f940a04476d66f0b933ddeaffc2660e8c12f852519d7dfe9345c6042fbb494e5804b65eac73ac67e1bcf817ae3c39f3
-
\??\c:\Users\Admin\AppData\Local\Temp\CSCE2CBE6F9B7A440B384FDD669DD464CA2.TMPFilesize
1KB
MD52c8070f084ff635f9e016b831cd6ef16
SHA184d8287a21eaf176ebd7b3efe8571b3862de873a
SHA256535d007133ddae112030480aac0b6954d4aac98bcd69b0ef192a010770564a4f
SHA512f7dd550984e579912cf8fa688c53985308862954688b44482c83c05d61274519812a5ea9b6ddcfcd8972d117c8e3edfa6da0e23f3c8ea17ef0bdab80bf0d4c1f
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.0.csFilesize
11KB
MD5e0a36923b6164cc78c6b826806bea306
SHA1635c852c004bd0056ca9e6b9bafd921eb2c9a99a
SHA256344f392d1fe43365e451f107567bf6cf036201bc85a18a1eaaf42141fc1ab231
SHA512f3508f1f4bc1f517c3ce83ebd721161ec173cb6b839d97dd009240ea638b4a2f1edda29aa7a09612eb7e88c28ff67f876a9345ce4a939005dead1559cc4a096f
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.1.csFilesize
5KB
MD58aab1997664a604aca551b20202bfd14
SHA1279cf8f218069cbf4351518ad6df9a783ca34bc5
SHA256029f57fa483bbcee0dd5464e0d4d89bd03032161424d0ffd1da2b3d5db15977f
SHA512cf0efea853d7e1997dcfcc9a73668ed9a5ac01cf22cbb7082a05abc141fccc7c92a936b245666071df75389cd7ebe60dc99b3c21279173fe12888a99034a5eda
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.2.csFilesize
7KB
MD56fdae9afc1f8e77e882f1ba6b5859a4e
SHA133eb96f75ffe9a1c4f94388e7465b997320265a5
SHA256a365264dd2d3388acc38b2f5c8f3c267bbf83ca463f70fbf6c8459123a7cc33d
SHA51297bb77e8c9c7a1a46fa416a917787ddced3439f72ea35558f22fa2450fbbd11928f3442baec0b33b14576683baa6c1c6b3e1376bd7742da358c808bf07db28e9
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.3.csFilesize
8KB
MD56ba707982ee7e5f0ae55ce3fa5ccad17
SHA1d094c98491058ed49861ce82701abe1f38385f18
SHA25619af9bea270f830354af8250cd82db32fdcab6327d139e2720713fb7d43a5797
SHA512d9cf480c32bfb806c72a2dc6fe211c4806388ccf548d55b059e633e8f814d46c80ef73eacfb02398fd3b1e75b7c44b8a1ba0b29476edbf9fe1b29322798d3cfa
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.4.csFilesize
2KB
MD5fae5458a5b3cee952e25d44d6eb9db85
SHA1060d40137e9cce9f40adbb3b3763d1f020601e42
SHA256240478bb9c522341906a0ef376e0188ce6106856a26a3ae0f7b58af07a377a06
SHA51225f406f747518aef3a1c5c3d66e8bd474429b05ef994303c5f7bc5d3669d691d9dc21ea8f8a35e20b84f8c406bf89835f2f5007a8f743df755e67b4c380fa236
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.5.csFilesize
4KB
MD542f157ad8e79e06a142791d6e98e0365
SHA1a05e8946e04907af3f631a7de1537d7c1bb34443
SHA256e30402cd45589982489719678adf59b016674faa6f7a9af074601e978cc9a0ed
SHA512e214e1cd49e677e1ed632e86e4d1680b0d04a7a0086a273422c14c28485dc549cc5b4bde13e45336f0c4b842751dfd6ef702df3524bc6570c477a4f713db09dc
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.6.csFilesize
6KB
MD58ec0f0e49ffe092345673ab4d9f45641
SHA1401bd9e2894e9098504f7cc8f8d52f86c3ebe495
SHA25693b9f783b5faed3ecfafbe20dfcf1bee3ce33f66909879cd39ae88c36acbdfac
SHA51260363b36587a3ace9ae1dbc21ffd39f903e5f51945eebdcf0316904eee316c9d711d7a014b28977d54eef25dec13f659aab06325f761d9f3ce9baca3cb12f248
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.7.csFilesize
16KB
MD505206d577ce19c1ef8d9341b93cd5520
SHA11ee5c862592045912eb45f9d94376f47b5410d3d
SHA256e2bbdc7ba4236f9c4cb829d63137fdac3a308fd5da96acea35212beafe01b877
SHA5124648fa7ea0a35a148e9dac1f659601ebf48910ca699ed9ef8d46614c7cbe14fcf47fa30dc87af53b987934a2a56cd71fd0e58182ef36a97ed47bd84637b54855
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.8.csFilesize
561B
MD57ae06a071e39d392c21f8395ef5a9261
SHA1007e618097c9a099c9f5c3129e5bbf1fc7deb930
SHA25600e152629bdbf25a866f98e6fc30626d2514527beef1b76ebb85b1f5f9c83718
SHA5125203c937597e51b97273040fe441392e0df7841f680fcca0d761ac6d47b72d02c8918614f030fbf23d8a58cb5625b702546e4c6f93e130cc5d3b41c154c42655
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.9.csFilesize
10KB
MD5380d15f61b0e775054eefdce7279510d
SHA147285dc55dafd082edd1851eea8edc2f7a1d0157
SHA256bef491a61351ad58cda96b73dba70027fdbe4966917e33145ba5cfa8c83bc717
SHA512d4cbaad29d742d55926fea6b3fa1cf754c3e71736e763d9271dc983e08fce5251fa849d4ecdc1187c29f92e27adab22b8f99791e46302b5d9c2e90b832c28c28
-
\??\c:\Users\Admin\AppData\Local\Temp\edkhkfaq\edkhkfaq.cmdlineFilesize
833B
MD51f38c96f8e5732ff727a823de50fc5ac
SHA11949d3fc6eb990314ec83b00c2ae89b16c373497
SHA2565173c6dfc341d8e609429f0593e801c14c27a9cad3f445e5b388df6f44c9229c
SHA5121f4245b84be6418f3b8a80a319b62e34db2d43356c602f6a08e59d3ba0923bd2bac36ec11b88aa4eed908c3f67ee11d5f084c77a46a9701375e64d651576bbde
-
memory/224-10-0x0000000005800000-0x0000000005814000-memory.dmpFilesize
80KB
-
memory/224-28-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-12-0x0000000005820000-0x000000000583E000-memory.dmpFilesize
120KB
-
memory/224-16-0x0000000005B90000-0x0000000005CDA000-memory.dmpFilesize
1.3MB
-
memory/224-17-0x00000000063A0000-0x00000000064B6000-memory.dmpFilesize
1.1MB
-
memory/224-18-0x0000000005D10000-0x0000000005D40000-memory.dmpFilesize
192KB
-
memory/224-19-0x0000000008F10000-0x0000000008F18000-memory.dmpFilesize
32KB
-
memory/224-20-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-21-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-22-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-23-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-24-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB
-
memory/224-25-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-26-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-27-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-13-0x00000000058E0000-0x0000000005916000-memory.dmpFilesize
216KB
-
memory/224-29-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-14-0x0000000005920000-0x000000000592E000-memory.dmpFilesize
56KB
-
memory/224-15-0x0000000005930000-0x000000000593E000-memory.dmpFilesize
56KB
-
memory/224-11-0x0000000005870000-0x00000000058DE000-memory.dmpFilesize
440KB
-
memory/224-0-0x00000000009D0000-0x0000000000D0A000-memory.dmpFilesize
3.2MB
-
memory/224-9-0x00000000057D0000-0x00000000057E0000-memory.dmpFilesize
64KB
-
memory/224-8-0x00000000057B0000-0x00000000057D0000-memory.dmpFilesize
128KB
-
memory/224-7-0x0000000005780000-0x00000000057A0000-memory.dmpFilesize
128KB
-
memory/224-6-0x00000000055D0000-0x00000000055EC000-memory.dmpFilesize
112KB
-
memory/224-5-0x0000000005550000-0x000000000555A000-memory.dmpFilesize
40KB
-
memory/224-4-0x0000000005860000-0x0000000005870000-memory.dmpFilesize
64KB
-
memory/224-3-0x00000000055F0000-0x0000000005682000-memory.dmpFilesize
584KB
-
memory/224-2-0x0000000005D70000-0x000000000626E000-memory.dmpFilesize
5.0MB
-
memory/224-1-0x0000000073DC0000-0x00000000744AE000-memory.dmpFilesize
6.9MB