Overview

overview

10

Static

static

10

Nexus.zip

windows10-ltsc 2021-x64

10

Analysis

  • max time kernel
    127s
  • max time network
    129s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241211-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    17-12-2024 08:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Nexus.zip

  • Size

    18KB

  • MD5

    bc9457efb3fd35f6272b812079671373

  • SHA1

    083b4d99f8dd897ad939027f092a4725c1070794

  • SHA256

    59c3b3b8a5be518fa876c8236c97fb5f267ca71f4ed8f68399dc6e58621741aa

  • SHA512

    deb8070618eb49c7b0e72a712d07901268f785d8b182ace85694137846a1d2be6e25b6d98d97a326f242e6e104be2cc4645af3b9e287fd106e4973a70eca7871

  • SSDEEP

    384:hxwixM+nFtfJl8L5f1Gvp+ESd3XJL9BvR0LodB2IP4QmN+tA1:hKi7Q/+Yh3ZRBvR0Cf1a+e1

Score
10/10
mercurialgrabberevasionspywarestealer

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/1318490592392515594/CaM0cAa4-Oi_iXHBiVS9ZB_zIfBiNf-F8okhA3-1UsMnWScS22GWWOOUK0emIKf2VNCQ

Signatures

  • Mercurial Grabber Stealer

    Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.

    stealermercurialgrabber
  • Mercurialgrabber family
    mercurialgrabber
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Checks SCSI registry key(s) 3 TTPs 2 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Nexus.zip"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3416
    • C:\Users\Admin\AppData\Local\Temp\7zO85D54537\Nexus Executor.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO85D54537\Nexus Executor.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2356
    • C:\Users\Admin\AppData\Local\Temp\7zO85D1CF28\Nexus Executor.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO85D1CF28\Nexus Executor.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Checks SCSI registry key(s)
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\7zO85D54537\Nexus Executor.exe
    Filesize

    41KB

    MD5

    a586b36675aec8a5c6ed50e92d388784

    SHA1

    68aa3dc9f30bfe1106f5d674a7d44b995879aa24

    SHA256

    3ade02051c85f82194e21864aac14868db1d62e925bf66c0ec3a537637ebdaee

    SHA512

    b69ac478c26ee6fbbcbdf4b94dd585e9263b51173e8f2f4b8032d7d5421605872a5d3eff3c0fc32fc9e281f0bad9f5471c4ed1543967b1b7935ff14ba57dcba6

    Download Submit

  • memory/2356-15-0x00007FFD23003000-0x00007FFD23005000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2356-16-0x00000000000E0000-0x00000000000F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/2356-17-0x00007FFD23000000-0x00007FFD23AC2000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2356-18-0x00007FFD23003000-0x00007FFD23005000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2356-19-0x00007FFD23000000-0x00007FFD23AC2000-memory.dmp

    Filesize

    10.8MB

    Download