Behavioral task
behavioral1
Sample
optimization.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
optimization.exe
Resource
win10v2004-20240802-en
General
-
Target
optimization.exe
-
Size
68KB
-
MD5
51d9d0a93081b537227b1a2ab44dc507
-
SHA1
c2cbb6e76cc2a6b31065a5eb1bf19ee1600c0c58
-
SHA256
5ec5f86f35a06554caedf23c766ad317fdc9eba5fb1242e063459d6d60dd805e
-
SHA512
89664bfc3395584e1cc6a2264ecb2e7995750309eba0416ddcc51d55fe5e659e80e30c5b2ade372e27941921e755b5fad04a052fe88b82fcdb2c89298dbf820e
-
SSDEEP
768:c2CZ9QLvnDylOcluZuLwnpTj9KZKfgm3Ehq5x/fK:c7AjnD9c7LwpTZF7EcPnK
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1277341597796925543/uBiSQjMIcZSjiE58SS7EsUdcpaONS8BCEIDgfigLN8z84blntDHVG1OHQj01TuM0t1rL
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource optimization.exe
Files
-
optimization.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ