Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240730-en - resource tags
- submitted
02/08/2024, 14:33
General
- Target Mercurial.exe
- Size 3.2MB
- Sample240802-rwvlsaxgll
- SHA256 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iy4zfifx\iy4zfifx.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES682B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC63BFD8F63F74F96AD10676349912438.TMP"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
RES682B.tmp
CSC63BFD8F63F74F96AD10676349912438.TMP
iy4zfifx.0.cs
iy4zfifx.1.cs
iy4zfifx.2.cs
iy4zfifx.3.cs
iy4zfifx.4.cs
iy4zfifx.5.cs
iy4zfifx.6.cs
iy4zfifx.7.cs
iy4zfifx.8.cs
iy4zfifx.9.cs
iy4zfifx.cmdline
memory/3420-11-0x0000000005F60000-0x0000000005FCE000-memory.dmp
memory/3420-28-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-15-0x0000000006080000-0x000000000608E000-memory.dmp
memory/3420-16-0x00000000068F0000-0x0000000006A3A000-memory.dmp
memory/3420-17-0x0000000006A40000-0x0000000006B56000-memory.dmp
memory/3420-18-0x00000000068B0000-0x00000000068E0000-memory.dmp
memory/3420-19-0x00000000096A0000-0x00000000096A8000-memory.dmp
memory/3420-20-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-21-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-22-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-23-0x000000007523E000-0x000000007523F000-memory.dmp
memory/3420-24-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-25-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-26-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-27-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-12-0x0000000005FE0000-0x0000000005FFE000-memory.dmp
memory/3420-29-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-13-0x0000000006020000-0x0000000006056000-memory.dmp
memory/3420-14-0x0000000006060000-0x000000000606E000-memory.dmp
memory/3420-0-0x000000007523E000-0x000000007523F000-memory.dmp
memory/3420-7-0x0000000005CD0000-0x0000000005CF0000-memory.dmp
memory/3420-10-0x0000000005F50000-0x0000000005F64000-memory.dmp
memory/3420-8-0x0000000005CF0000-0x0000000005D10000-memory.dmp
memory/3420-9-0x0000000005F40000-0x0000000005F50000-memory.dmp
memory/3420-6-0x0000000005C80000-0x0000000005C9C000-memory.dmp
memory/3420-5-0x0000000005C70000-0x0000000005C7A000-memory.dmp
memory/3420-4-0x0000000075230000-0x00000000759E0000-memory.dmp
memory/3420-3-0x0000000005D20000-0x0000000005DB2000-memory.dmp
memory/3420-2-0x00000000062D0000-0x0000000006874000-memory.dmp
memory/3420-1-0x0000000000F40000-0x000000000127A000-memory.dmp
memory/3420-61-0x0000000075230000-0x00000000759E0000-memory.dmp