Behavioral task
behavioral1
Sample
d7f4ceb2e023f51d23cafa4a30da811f3abb864d6c938a36f9326f4c16cac7f3.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
d7f4ceb2e023f51d23cafa4a30da811f3abb864d6c938a36f9326f4c16cac7f3.exe
Resource
win10v2004-20240709-en
General
-
Target
d7f4ceb2e023f51d23cafa4a30da811f3abb864d6c938a36f9326f4c16cac7f3
-
Size
108KB
-
MD5
1d57d1eca8ab1bf9fce8c2acdf4ea3e1
-
SHA1
04c9de89db5b5054d7ce32a908b7f0755222b5f8
-
SHA256
d7f4ceb2e023f51d23cafa4a30da811f3abb864d6c938a36f9326f4c16cac7f3
-
SHA512
ca56337c05a835fe663e03acce20e4effbb0f19752781009ba6d22afd0e01c38a7afc49604b8d72188ac4b227f7063cd0a66a6c6578258c9528964fda1672b33
-
SSDEEP
768:v/WtmlL9ra82jeuZ7LPiTjjvKZKfgm3EhutCC2csDjnFBR/y:W8lL9rcbLPiT/vF7EctCVcsDjFBRq
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1261474088715681844/6ilYIvPPU2c2NVjM7RrEeVsbmo3iDhKyRwlRyw7Bxp1N4YDGJ0J-WRHDuY4sSd0hQSb6
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d7f4ceb2e023f51d23cafa4a30da811f3abb864d6c938a36f9326f4c16cac7f3
Files
-
d7f4ceb2e023f51d23cafa4a30da811f3abb864d6c938a36f9326f4c16cac7f3.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ