Analysis
- max time kernel
1341s - max time network
1165s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
03/08/2024, 01:44
General
- Target Mercurial.exe
- Size 3.2MB
- Sample240803-b5tsvatcpg
- SHA256 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4960-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp
memory/4960-1-0x0000000000D50000-0x000000000108A000-memory.dmp
memory/4960-2-0x0000000006090000-0x0000000006634000-memory.dmp
memory/4960-3-0x0000000005AE0000-0x0000000005B72000-memory.dmp
memory/4960-4-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-5-0x0000000005AA0000-0x0000000005AAA000-memory.dmp
memory/4960-6-0x0000000005AB0000-0x0000000005ACC000-memory.dmp
memory/4960-7-0x0000000005CF0000-0x0000000005D10000-memory.dmp
memory/4960-9-0x0000000005D50000-0x0000000005D60000-memory.dmp
memory/4960-11-0x0000000005D70000-0x0000000005DDE000-memory.dmp
memory/4960-15-0x0000000005E90000-0x0000000005E9E000-memory.dmp
memory/4960-14-0x0000000005E70000-0x0000000005E7E000-memory.dmp
memory/4960-13-0x0000000005E30000-0x0000000005E66000-memory.dmp
memory/4960-12-0x0000000005DF0000-0x0000000005E0E000-memory.dmp
memory/4960-8-0x0000000005D10000-0x0000000005D30000-memory.dmp
memory/4960-10-0x0000000005D60000-0x0000000005D74000-memory.dmp
memory/4960-16-0x0000000006800000-0x000000000694A000-memory.dmp
memory/4960-17-0x00000000069B0000-0x0000000006AC6000-memory.dmp
memory/4960-18-0x0000000006010000-0x0000000006040000-memory.dmp
memory/4960-19-0x00000000094B0000-0x00000000094B8000-memory.dmp
memory/4960-20-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-21-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-22-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-23-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-24-0x0000000074E4E000-0x0000000074E4F000-memory.dmp
memory/4960-25-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-26-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-27-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-28-0x0000000074E40000-0x00000000755F0000-memory.dmp
memory/4960-29-0x0000000074E40000-0x00000000755F0000-memory.dmp