Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 07:01
Static task
static1
Behavioral task
behavioral1
Sample
1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe
Resource
win10v2004-20241007-en
General
-
Target
1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe
-
Size
784KB
-
MD5
e07c386723cf4f814e6a8a6774813649
-
SHA1
760e741c4177f63a2b050e8afb6a9fb3ac23f4e2
-
SHA256
1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81
-
SHA512
cf236c67d69d664676b3d2190f2719ee81e0f7404156a9a3e405fe35cac4288d29ce4398247f32e6425a103baf8e67f87553b4cca7706d9a2f28c3feaa585c4a
-
SSDEEP
24576:DR+cl7X1BRnI6hmebOe19fNaBA+ZVvCnrkbDmdsQ:1+clb1BRntmeSK9fNaBA+ZVqrNd3
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/897281916594696252/GXBeXRQpAlm4tCQFFzK8Lo3HvApM27S7weWPV234nZ_z6r7XNlxx7P-AdodS9jkzznk0
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Mercurialgrabber family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions archivo.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools archivo.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion archivo.exe -
Executes dropped EXE 2 IoCs
pid Process 2832 archivo1.exe 2692 archivo.exe -
Loads dropped DLL 1 IoCs
pid Process 2900 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum archivo.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 archivo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S archivo.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation archivo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer archivo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName archivo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 archivo.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2900 2648 1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe 30 PID 2648 wrote to memory of 2900 2648 1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe 30 PID 2648 wrote to memory of 2900 2648 1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe 30 PID 2900 wrote to memory of 2832 2900 cmd.exe 32 PID 2900 wrote to memory of 2832 2900 cmd.exe 32 PID 2900 wrote to memory of 2832 2900 cmd.exe 32 PID 2832 wrote to memory of 2692 2832 archivo1.exe 33 PID 2832 wrote to memory of 2692 2832 archivo1.exe 33 PID 2832 wrote to memory of 2692 2832 archivo1.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe"C:\Users\Admin\AppData\Local\Temp\1bdf2d64894f6ae05948436ee261bc8492611aae9feca26751934c79e5aabf81.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\batch.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\archivo1.exearchivo1.exe -pTKrVj0QLiM@B -dC:\Users\Admin\AppData\Local\Temp3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\archivo.exe"C:\Users\Admin\AppData\Local\Temp\archivo.exe"4⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:2692
-
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247KB
MD53b58d2e3bf6ecc62788d2ae9c9263993
SHA1593cf703c9ec0337beabd33490dfba3611e4c8ff
SHA25601a2341c90513bd7a5d4a0056d6fb2b738ded6815d69d658f75ece3ec69a0da5
SHA51225941294c8be557c585d5b1439aa36eb2603c24376f7cd4afd71be9921b671f138fd5b51d2472b009c45af97077e53bbe4eda24abdd4e6b1fd51a0b535563a9a
-
Filesize
36B
MD5486b32470cd742f64c8fb53028741c20
SHA10708eb80c6576b1a10c3edaaec6bf19ccc4a1c8f
SHA2563a77cd2117a565ad1542fb2f3350efb0df2b0df44b62eaa1390762840873d4b1
SHA512d0841a2643add340a97086ec61dbf5242147c113bdeb095563406e904504ec0fa7b8644c7d317ee7a2d906696066544209a974830d0484494c280aeefd93c73b
-
Filesize
430KB
MD53095813f46a4ce671fc905371093997a
SHA12336b50502e71536749e89e8a5b0699ad33bb0a5
SHA25682e51d2f9029e76ebb1ac4bc86bb8c0d10b443398520e7718c9c697a0d834c78
SHA512fd273825676df8050f049c45edae76ae4ccd6153fb4cc719be59ecc96b2d6b6257d25b6b91bee8228e30abf21960690bd7f9c52f477cdf64ee1704a35141b1ea