Behavioral task
behavioral1
Sample
ImgLogger.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ImgLogger.exe
Resource
win10v2004-20240704-en
General
-
Target
ImgLogger.exe
-
Size
45KB
-
MD5
37206d445dfcea8bf0e07f6dbcf421de
-
SHA1
a0fe6e2635f7e88255acc1bfde050ff1744ed220
-
SHA256
48cd44b7ab05263304534ff91c507d1151cc62087f0e56805b5d6d400f6ed7d3
-
SHA512
af2e37cf2c0aaa8f4444b9da41c07ce731a62a0dad56c202a0a2eb9f7128690538e3720d511963980dd574b57aa6c082d49d8f7ed802868125608a974e9596be
-
SSDEEP
768:rmtVdxCG5Q7YBNuZSLbLTjjKZKfgm3EhhSDW:cxJBFLbLTfF7EjS
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1259467309756710993/xiTXl12FOdfO8JQ3DMnZ1_AGTHk4YoTVGukaIJ83I-lYVjcsqNcrtEPDqJ0Pc8vR7_mp
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource ImgLogger.exe
Files
-
ImgLogger.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ