Behavioral task
behavioral1
Sample
macha.exe
Resource
win11-20241023-en
General
-
Target
macha.exe
-
Size
42KB
-
MD5
48cab8d73ba27f3990d161abb3021454
-
SHA1
78c64682a8c83a4259773c22fcf7f8a93893e2c4
-
SHA256
f3c4dfd663e9d4a169a366c2066151ed7a6d90518c48a37ec7e7e049b20dadbc
-
SHA512
573ce2c09b7935eeab753ed501e3bd911fe5b8215a1fa41301d4ddc72c80af743934a1be95a625304a0e09c9217924f5e1938b0aaa4293ce5cb86334e8543912
-
SSDEEP
768:Sn3hV/Wk1gOv+Zm5uZ3L0B5Tj/DKZKfgm3EhOK:Sn3zPVmZRL0B5TbDF7EwK
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1307696182356738058/2ZtmsL_00u_QG3b8STUXzksuUTZIf8kM5WOKkhjseNs3wt-TD_MMCcRfelDdRESetj8Z
Signatures
-
Mercurialgrabber family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource macha.exe
Files
-
macha.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ