mercurialgrabber | 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mercurial.exe
Size

3.2MB
MD5

a9477b3e21018b96fc5d2264d4016e65
SHA1

493fa8da8bf89ea773aeb282215f78219a5401b7
SHA256

890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
SHA512

66529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
SSDEEP

98304:5kjozJ9/im8XVBKl6t1buVfRhq+5tXzgCa/T:lzJpjS346t1bIfuq07

Score

10^/10

mercurialgrabber agilenet discovery stealer

Malware Config

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Mercurialgrabber family
mercurialgrabber

Obfuscated with Agile.Net obfuscator 11 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/2428-2-0x0000000000700000-0x000000000071C000-memory.dmp	agile_net
behavioral1/memory/2428-4-0x00000000008A0000-0x00000000008C0000-memory.dmp	agile_net
behavioral1/memory/2428-5-0x00000000008C0000-0x00000000008E0000-memory.dmp	agile_net
behavioral1/memory/2428-6-0x0000000000750000-0x0000000000760000-memory.dmp	agile_net
behavioral1/memory/2428-7-0x0000000000920000-0x0000000000934000-memory.dmp	agile_net
behavioral1/memory/2428-8-0x0000000004680000-0x00000000046EE000-memory.dmp	agile_net
behavioral1/memory/2428-9-0x0000000000930000-0x000000000094E000-memory.dmp	agile_net
behavioral1/memory/2428-10-0x00000000021F0000-0x0000000002226000-memory.dmp	agile_net
behavioral1/memory/2428-11-0x0000000000C10000-0x0000000000C1E000-memory.dmp	agile_net
behavioral1/memory/2428-12-0x0000000002230000-0x000000000223E000-memory.dmp	agile_net
behavioral1/memory/2428-13-0x0000000004D80000-0x0000000004ECA000-memory.dmp	agile_net

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mercurial.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2428	Mercurial.exe
2428	Mercurial.exe
2428	Mercurial.exe
2428	Mercurial.exe
2428	Mercurial.exe
2428	Mercurial.exe
2428	Mercurial.exe
2428	Mercurial.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	Mercurial.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2428	Mercurial.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 1644	2428	Mercurial.exe	31
PID 2428 wrote to memory of 1644	2428	Mercurial.exe	31
PID 2428 wrote to memory of 1644	2428	Mercurial.exe	31
PID 2428 wrote to memory of 1644	2428	Mercurial.exe	31
PID 1644 wrote to memory of 940	1644	csc.exe	33
PID 1644 wrote to memory of 940	1644	csc.exe	33
PID 1644 wrote to memory of 940	1644	csc.exe	33
PID 1644 wrote to memory of 940	1644	csc.exe	33
PID 2428 wrote to memory of 2124	2428	Mercurial.exe	34
PID 2428 wrote to memory of 2124	2428	Mercurial.exe	34
PID 2428 wrote to memory of 2124	2428	Mercurial.exe	34
PID 2428 wrote to memory of 2124	2428	Mercurial.exe	34
PID 2124 wrote to memory of 1312	2124	csc.exe	36
PID 2124 wrote to memory of 1312	2124	csc.exe	36
PID 2124 wrote to memory of 1312	2124	csc.exe	36
PID 2124 wrote to memory of 1312	2124	csc.exe	36

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB3E4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC3BAE00F9B7145D0BEE11D49B2AAB23.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u5z3sx50\u5z3sx50.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB461.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6115C00EBD474424BCEF7F9CB8F811FD.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESB3E4.tmp

Filesize
1KB

MD5
75baf3ac54bfb19d114ff3864fab16b8

SHA1
7abb1da50231b43b5b31f2c01fcada0ddb43d9f8

SHA256
68126e441101c2002d507adc45a8642887be9dc1fe151e0ac0c5ca0f13fa0570

SHA512
c00d63a67c0bf813380087c0e3ed629686f66d0d0a64e9fa46549df8b3129dcde43e81b194788d8a9a3961df9ea202c6aba71fc93678109e74d3c27d73018e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB461.tmp

Filesize
1KB

MD5
4ff53d8e2ff14a55a13835c62d8f613f

SHA1
4748a2c4a634c8a3a0e3e8b4d8fd21a29d8d7374

SHA256
2b0798b53244355cd9b417723046dddc8dda7d4cff1bfdaaac7cdc02e6b417ed

SHA512
5e99b1530481753f848df2ccc4fd36a4483ce48cace44594dcec2e9847fff66635788806666ed5fb4f29d5e08ce16c4a8abb67b7c7c5d9dde343f1a00823e1e3

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.0.cs

Filesize
11KB

MD5
6e09c67b55a62916fc9204eff6877bf0

SHA1
5bdd02efc746008dbbb8704eecffbf34136b8695

SHA256
a4962989573ad9ff719db89381e95c64f6e0be84f31d20d346a2df632b9c9adf

SHA512
362aa38ddffeea66f1cb2ba7d42e2f0754c9b1b28a8e7b0f794ebcfc74043349e5ee9e2b58720af89d3612e0d6931b47ac12f11be274ca271227e8e622ef01e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.1.cs

Filesize
5KB

MD5
8aab1997664a604aca551b20202bfd14

SHA1
279cf8f218069cbf4351518ad6df9a783ca34bc5

SHA256
029f57fa483bbcee0dd5464e0d4d89bd03032161424d0ffd1da2b3d5db15977f

SHA512
cf0efea853d7e1997dcfcc9a73668ed9a5ac01cf22cbb7082a05abc141fccc7c92a936b245666071df75389cd7ebe60dc99b3c21279173fe12888a99034a5eda

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.2.cs

Filesize
7KB

MD5
6fdae9afc1f8e77e882f1ba6b5859a4e

SHA1
33eb96f75ffe9a1c4f94388e7465b997320265a5

SHA256
a365264dd2d3388acc38b2f5c8f3c267bbf83ca463f70fbf6c8459123a7cc33d

SHA512
97bb77e8c9c7a1a46fa416a917787ddced3439f72ea35558f22fa2450fbbd11928f3442baec0b33b14576683baa6c1c6b3e1376bd7742da358c808bf07db28e9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.3.cs

Filesize
8KB

MD5
6ba707982ee7e5f0ae55ce3fa5ccad17

SHA1
d094c98491058ed49861ce82701abe1f38385f18

SHA256
19af9bea270f830354af8250cd82db32fdcab6327d139e2720713fb7d43a5797

SHA512
d9cf480c32bfb806c72a2dc6fe211c4806388ccf548d55b059e633e8f814d46c80ef73eacfb02398fd3b1e75b7c44b8a1ba0b29476edbf9fe1b29322798d3cfa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.4.cs

Filesize
2KB

MD5
fae5458a5b3cee952e25d44d6eb9db85

SHA1
060d40137e9cce9f40adbb3b3763d1f020601e42

SHA256
240478bb9c522341906a0ef376e0188ce6106856a26a3ae0f7b58af07a377a06

SHA512
25f406f747518aef3a1c5c3d66e8bd474429b05ef994303c5f7bc5d3669d691d9dc21ea8f8a35e20b84f8c406bf89835f2f5007a8f743df755e67b4c380fa236

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.5.cs

Filesize
4KB

MD5
42f157ad8e79e06a142791d6e98e0365

SHA1
a05e8946e04907af3f631a7de1537d7c1bb34443

SHA256
e30402cd45589982489719678adf59b016674faa6f7a9af074601e978cc9a0ed

SHA512
e214e1cd49e677e1ed632e86e4d1680b0d04a7a0086a273422c14c28485dc549cc5b4bde13e45336f0c4b842751dfd6ef702df3524bc6570c477a4f713db09dc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.6.cs

Filesize
6KB

MD5
8ec0f0e49ffe092345673ab4d9f45641

SHA1
401bd9e2894e9098504f7cc8f8d52f86c3ebe495

SHA256
93b9f783b5faed3ecfafbe20dfcf1bee3ce33f66909879cd39ae88c36acbdfac

SHA512
60363b36587a3ace9ae1dbc21ffd39f903e5f51945eebdcf0316904eee316c9d711d7a014b28977d54eef25dec13f659aab06325f761d9f3ce9baca3cb12f248

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.7.cs

Filesize
16KB

MD5
05206d577ce19c1ef8d9341b93cd5520

SHA1
1ee5c862592045912eb45f9d94376f47b5410d3d

SHA256
e2bbdc7ba4236f9c4cb829d63137fdac3a308fd5da96acea35212beafe01b877

SHA512
4648fa7ea0a35a148e9dac1f659601ebf48910ca699ed9ef8d46614c7cbe14fcf47fa30dc87af53b987934a2a56cd71fd0e58182ef36a97ed47bd84637b54855

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.8.cs

Filesize
561B

MD5
7ae06a071e39d392c21f8395ef5a9261

SHA1
007e618097c9a099c9f5c3129e5bbf1fc7deb930

SHA256
00e152629bdbf25a866f98e6fc30626d2514527beef1b76ebb85b1f5f9c83718

SHA512
5203c937597e51b97273040fe441392e0df7841f680fcca0d761ac6d47b72d02c8918614f030fbf23d8a58cb5625b702546e4c6f93e130cc5d3b41c154c42655

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.9.cs

Filesize
10KB

MD5
380d15f61b0e775054eefdce7279510d

SHA1
47285dc55dafd082edd1851eea8edc2f7a1d0157

SHA256
bef491a61351ad58cda96b73dba70027fdbe4966917e33145ba5cfa8c83bc717

SHA512
d4cbaad29d742d55926fea6b3fa1cf754c3e71736e763d9271dc983e08fce5251fa849d4ecdc1187c29f92e27adab22b8f99791e46302b5d9c2e90b832c28c28

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\423uiphj\423uiphj.cmdline

Filesize
833B

MD5
2e3bd45fddc7c9b4566bb22a95299521

SHA1
9b151cefb4d70f6d3c3a643cfe05b2ed4ce7d956

SHA256
a8a7366d9a1589460c8277eb875a80008b551c7e301cbe7a58e34fe7d68e32eb

SHA512
9df1335accda2e33cc7e64295e5b78033d916d5231690489bb9f3cb01fa1ce545b3d1314a241cdb43128611aaae61b0760113808447c4fece86c3ce51b74026a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCC3BAE00F9B7145D0BEE11D49B2AAB23.TMP

Filesize
1KB

MD5
2c8070f084ff635f9e016b831cd6ef16

SHA1
84d8287a21eaf176ebd7b3efe8571b3862de873a

SHA256
535d007133ddae112030480aac0b6954d4aac98bcd69b0ef192a010770564a4f

SHA512
f7dd550984e579912cf8fa688c53985308862954688b44482c83c05d61274519812a5ea9b6ddcfcd8972d117c8e3edfa6da0e23f3c8ea17ef0bdab80bf0d4c1f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\output.exe

Filesize
41KB

MD5
d78dad437d34daa9d0c4e17cd4cbe9b3

SHA1
96d504d9e67ce7be003e19cbae6fdb6d07a543ec

SHA256
da0b42829b0ef4149cbad067b0e5fc1deaee1ec9c4ca7d051ee70f40fa8127b6

SHA512
060c481de92bc40f571aa7b59c6c1ca127d575e9c6e8de2c99df0579fbaecb175751bbf721a7ab5aca1986867185e68f4b0c5a4c9abbc75b40ce50691974923b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u5z3sx50\u5z3sx50.cmdline

Filesize
833B

MD5
f05dcbc7831eccd7c695237ed9eabaa2

SHA1
d086bf469cb009e35bed6b3ac47747e4adba353a

SHA256
ae724852b56af70ad4fbcbd5676ecb0064863b657020bd64346079068660f414

SHA512
1629c9a289b162616879f2745934f283d06708b9c43eeec1516f4c81cdf5b8e41019e280607011e80706540275464faeb757c077d88b3721cc91aacb1c0ec4a6

Download Submit
memory/2428-10-0x00000000021F0000-0x0000000002226000-memory.dmp

Filesize
216KB

Download
memory/2428-14-0x00000000054B0000-0x00000000055C6000-memory.dmp

Filesize
1.1MB

Download
memory/2428-18-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-19-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-20-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-21-0x0000000073C0E000-0x0000000073C0F000-memory.dmp

Filesize
4KB

Download
memory/2428-22-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-23-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-24-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-25-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-26-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-16-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-15-0x00000000043F0000-0x0000000004420000-memory.dmp

Filesize
192KB

Download
memory/2428-17-0x0000000004BE0000-0x0000000004BE8000-memory.dmp

Filesize
32KB

Download
memory/2428-13-0x0000000004D80000-0x0000000004ECA000-memory.dmp

Filesize
1.3MB

Download
memory/2428-12-0x0000000002230000-0x000000000223E000-memory.dmp

Filesize
56KB

Download
memory/2428-11-0x0000000000C10000-0x0000000000C1E000-memory.dmp

Filesize
56KB

Download
memory/2428-0-0x0000000073C0E000-0x0000000073C0F000-memory.dmp

Filesize
4KB

Download
memory/2428-9-0x0000000000930000-0x000000000094E000-memory.dmp

Filesize
120KB

Download
memory/2428-8-0x0000000004680000-0x00000000046EE000-memory.dmp

Filesize
440KB

Download
memory/2428-7-0x0000000000920000-0x0000000000934000-memory.dmp

Filesize
80KB

Download
memory/2428-6-0x0000000000750000-0x0000000000760000-memory.dmp

Filesize
64KB

Download
memory/2428-5-0x00000000008C0000-0x00000000008E0000-memory.dmp

Filesize
128KB

Download
memory/2428-4-0x00000000008A0000-0x00000000008C0000-memory.dmp

Filesize
128KB

Download
memory/2428-2-0x0000000000700000-0x000000000071C000-memory.dmp

Filesize
112KB

Download
memory/2428-3-0x0000000073C00000-0x00000000742EE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-1-0x0000000000120000-0x000000000045A000-memory.dmp

Filesize
3.2MB

Download