b7dd3bce3ebfbc2d5e3a9f00d47f27cb6a5895c4618c878e314e573a7c216df1

Analysis

max time kernel
108s
max time network
147s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
04/01/2025, 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo-master/Email-Worm/Merkur.exe
Size

44KB
MD5

e6f8f701d646b193139cf0a92229455f
SHA1

b7747d41fcf52c3611af1153e46183dacbb3c709
SHA256

7e89fabfdbe214bf6a6f9730f3e451e69f752b62bbd54c0a81d2aae2320abd2c
SHA512

135d69ed4b3acdeaf45639090cefd48fa02f9ff1fb168d249717d0e2d3295530b697d8ff3fea84fa20a66aeb99437e5b0f2a2c3936f2a109c1068816263003ae
SSDEEP

384:/T16PQm7lU7lnDSLOwglunEuMhlkW3YpCzkVei7kVrcwh8PDM9TkLJI4WvEfbqgJ:/hdmCJq1glWlOEDvEo2k/2w/mo

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	\??\c:\Windows\SysWOW64\regme.reg	Merkur.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	\??\c:\program files\bearshare\shared\IPspoofer.exe	Merkur.exe
File created	\??\c:\program files\kazaa\my shared folder\Virtual Sex Simulator.exe	Merkur.exe
File created	\??\c:\program files\bearshare\shared\Virtual Sex Simulator.exe	Merkur.exe
File created	\??\c:\program files\eDonkey2000\incoming\Virtual Sex Simulator.exe	Merkur.exe
File created	\??\c:\Program Files\mIRC\script.ini	Merkur.exe
File created	\??\c:\program files\eDonkey2000\incoming\IPspoofer.exe	Merkur.exe
File created	\??\c:\program files\kazaa\my shared folder\IPspoofer.exe	Merkur.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\screensaver.exe	Merkur.exe
File created	\??\c:\WINDOWS\taskman.exe	Merkur.exe
File opened for modification	\??\c:\WINDOWS\taskman.exe	Merkur.exe
File created	\??\c:\Windows\System\AVupdate.exe	Merkur.exe
File opened for modification	\??\c:\Windows\System\AVupdate.exe	Merkur.exe
File created	\??\c:\Windows\Notepad.exe	Merkur.exe
File created	\??\c:\windows\screensaver.exe	Merkur.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Merkur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4216	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4704	Merkur.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 4216	4704	Merkur.exe	81
PID 4704 wrote to memory of 4216	4704	Merkur.exe	81
PID 4704 wrote to memory of 4216	4704	Merkur.exe	81
PID 4704 wrote to memory of 4648	4704	Merkur.exe	82
PID 4704 wrote to memory of 4648	4704	Merkur.exe	82
PID 4704 wrote to memory of 4648	4704	Merkur.exe	82

C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Merkur.exe
"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Email-Worm\Merkur.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\SysWOW64\regedit.exe
  regedit /s c:\Windows\system32\regme.reg
  2⤵
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:4216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\pr0n.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System\AVupdate.exe

Filesize
44KB

MD5
e6f8f701d646b193139cf0a92229455f

SHA1
b7747d41fcf52c3611af1153e46183dacbb3c709

SHA256
7e89fabfdbe214bf6a6f9730f3e451e69f752b62bbd54c0a81d2aae2320abd2c

SHA512
135d69ed4b3acdeaf45639090cefd48fa02f9ff1fb168d249717d0e2d3295530b697d8ff3fea84fa20a66aeb99437e5b0f2a2c3936f2a109c1068816263003ae

Download Submit
\??\c:\Windows\SysWOW64\regme.reg

Filesize
126B

MD5
1065f6f41c70e40297555b6d1878e823

SHA1
18b6b3b6da306b12c7b1f197d6242d2f66703023

SHA256
ab59535ddcea09a82c549ab4f72e0459cc57e41f5b887c42afde0a1dc1ae9947

SHA512
25aac67f601ad21878bd0c92bec8e68433dbdb05621f74d5d23c0b0db1960313e695ce6082abaa82e7ab922323e1fbdd0f9a484ae2cf01abecf431cb4bee5ea8

Download Submit