Overview

overview

10

Static

static

10

Mercurial.exe

windows7-x64

10

Mercurial.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Mercurial.exe
  • Size 41KB
  • Sample240823-erwbasxbkl
  • SHA256 b6888dd4fee5c165225fe1006560b751d769d0debe65e14e98f4d8cabe3e4bcf
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
mercurialgrabbercredential_accessdiscoveryevasionspywarestealer

Malware Config

Extracted

Family

  • mercurialgrabber

C2

  • https://discord.com/api/webhooks/898068237718261761/KniB9I7FAGbgiwGV6ub2_uE7GuQWTm94T_kcHonylqs73StuEGI3OqzKwT56iONTU2oh

Targets

    • Target
      Mercurial.exe
    • Size 41KB
    • SHA256 b6888dd4fee5c165225fe1006560b751d769d0debe65e14e98f4d8cabe3e4bcf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    mercurialgrabbercredential_accessevasionspywarestealerdiscovery

    • Mercurial Grabber Stealer

      Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

      stealermercurialgrabber

    • Credentials from Password Stores: Credentials from Web Browsers

      Malicious Access or copy of Web Browser Credential store.

      credential_accessstealer

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks