Analysis
-
max time kernel
24s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-08-2024 02:42
General
-
Target
Celesty.exe
-
Size
1.7MB
-
MD5
8966d25141f5e150ff7d02ac502cce46
-
SHA1
f882485d1ffac1b75b60794824b771e4ce33d7b7
-
SHA256
8694257c04deed3937833145954c65564627f7d40cd20f8401696933a03b7e3f
-
SHA512
caedef6e8fdc042d6586816bdc87c36b3d40c22a8e4e331d46296b669ed03f2e295f4b44ed4092f43e8d0dad8cc40766982d6938d1d638fb4e4eecaddd529df3
-
SSDEEP
49152:6PxCjaDpascfyHTtgWc79pGvFog9hlQ0xM7QYeYnUgy:mCq4sokTtlPFooQzzU/
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/935223250571640882/ViB43kUXE9CCFxm2v1jxJfLyHYVNk3Y3-laU94OpWmJjw7id0TwbDJUP1by4-O7zvfZu
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Celesty.exe"C:\Users\Admin\AppData\Local\Temp\Celesty.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4388,i,3210801877307184477,8078594481454001567,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:81⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
Filesize
41KB
MD54cc81e53b9037673b9014431e9be0e60
SHA162c57cbad6be321e65bea71bd87801fcb0bf7af9
SHA2561baf3f560a47aacd9a841939ff127fbade26095dd47867dfec38bc2f1fa4a9ad
SHA512dae96f885d20fe185302f689f844032797209b28d1295444a29fa730d01b520e7994121fe8bd2b55c0d21b395da372a9846d9dec5960edfecd40ac41690d36ff
-
Filesize
2.8MB
MD5d604d3ac515faf6ad32e8e57c170d389
SHA102069909d405b33af28da67ad232013307a198b2
SHA2565d3955502a6b63e394eea67aad6c83dfa80d08484d9f11956e77ec5b47c6f8b8
SHA512bb1d77a7430204eef2ecb3cdfb7d2b2b5f80f9f5fefee6cbff2fc69538523177e8010d9dc4b353f4adc4c6bdba2c398ceac90ce43a1302b2cdf5149dd7680817
-
Filesize
64KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB