Analysis
- max time kernel
120s - max time network
120s - platform
windows7_x64 - resource
win7-20240704-en - resource tags
- submitted
21/08/2024, 03:11
General
- Target Mercurial.exe
- Size 3.2MB
- Sample240821-dp26ds1dmp
- SHA256 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2092-0-0x0000000073EEE000-0x0000000073EEF000-memory.dmp
memory/2092-1-0x0000000000A70000-0x0000000000DAA000-memory.dmp
memory/2092-2-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-3-0x00000000003A0000-0x00000000003BC000-memory.dmp
memory/2092-4-0x0000000000530000-0x0000000000550000-memory.dmp
memory/2092-5-0x00000000005B0000-0x00000000005D0000-memory.dmp
memory/2092-6-0x0000000000560000-0x0000000000570000-memory.dmp
memory/2092-7-0x0000000000620000-0x0000000000634000-memory.dmp
memory/2092-8-0x00000000046D0000-0x000000000473E000-memory.dmp
memory/2092-9-0x00000000009F0000-0x0000000000A0E000-memory.dmp
memory/2092-10-0x0000000002570000-0x00000000025A6000-memory.dmp
memory/2092-11-0x0000000002340000-0x000000000234E000-memory.dmp
memory/2092-12-0x0000000002350000-0x000000000235E000-memory.dmp
memory/2092-13-0x0000000004FC0000-0x000000000510A000-memory.dmp
memory/2092-14-0x0000000005310000-0x0000000005426000-memory.dmp
memory/2092-15-0x0000000004740000-0x0000000004770000-memory.dmp
memory/2092-16-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-17-0x0000000005550000-0x0000000005558000-memory.dmp
memory/2092-18-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-19-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-20-0x0000000073EEE000-0x0000000073EEF000-memory.dmp
memory/2092-21-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-22-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-23-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-24-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-25-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-26-0x0000000073EE0000-0x00000000745CE000-memory.dmp
memory/2092-27-0x0000000073EE0000-0x00000000745CE000-memory.dmp