Resubmissions
18/08/2024, 11:58
240818-n5ltfssgpb1009/08/2024, 18:46
240809-xe5nbathlk1009/08/2024, 17:51
240809-wfdesaxcqh1009/08/2024, 17:48
240809-wdej3axcpf1009/08/2024, 17:46
240809-wcf2haxcpc10Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
- submitted
09/08/2024, 17:46
General
- Target Garnacho.exe
- Size 42KB
- Sample240809-wcf2haxcpc
- SHA256 e1d670f21441ec457fe5c3469781c101c36b4fe04b2ffc1a2e89eb630ff0165a
Malware Config
Extracted
-
mercurialgrabber
-
https://discord.com/api/webhooks/1271524572986081351/vNrcEfNWPV35KkYiGtVh2NaZB_4a4uGfbaOAe2oVr7jGqwHkIB78Aj1CzHbPqMm3KbjD
Signatures
- Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 35 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Garnacho.exe"C:\Users\Admin\AppData\Local\Temp\Garnacho.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2408 -s 13962⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2408-0-0x000007FEF67C3000-0x000007FEF67C4000-memory.dmp
memory/2408-1-0x00000000000A0000-0x00000000000B0000-memory.dmp
memory/2408-2-0x000007FEF67C0000-0x000007FEF71AC000-memory.dmp
memory/2408-3-0x000007FEF67C3000-0x000007FEF67C4000-memory.dmp
memory/2408-5-0x000007FEF67C0000-0x000007FEF71AC000-memory.dmp
memory/2408-6-0x000007FEF67C0000-0x000007FEF71AC000-memory.dmp
memory/2808-4-0x0000000140000000-0x00000001405E8000-memory.dmp