Analysis
-
max time kernel
33s -
max time network
25s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250207-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250207-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
07/02/2025, 11:45
Behavioral task
behavioral1
Sample
skeet/skeet.exe
Resource
win10ltsc2021-20250207-en
windows10-ltsc 2021-x64
13 signatures
150 seconds
General
-
Target
skeet/skeet.exe
-
Size
41KB
-
MD5
da76f361f0e88dbb3b4a17de18a05681
-
SHA1
9f3e38b99620a8381fc3a262f0f49a88ffee3dbf
-
SHA256
8ec7c1dd4c94af0de4d6e04f237dc501d9e2a23f55835ad33b480583f0053603
-
SHA512
ddc6b4204def36c64b3e5d1e378437ec553305d9fdf3f2891ef1c02c23de257d8774a6a07d7df4f6d0bd55acdd8687d4b51c3257b508f09da9384449736e9144
-
SSDEEP
768:+scaIiIEaL/gB1w1guZBeyWTjh0KZKfgm3Ehto:Nc1yargB0eyWT90F7Ero
Score
10/10
Malware Config
Extracted
Family
mercurialgrabber
C2
https://discord.com/api/webhooks/1337096942567555163/_OuVbk2ZGBIMjuPwPIIiqP2viOEm896TkaBwPFoXA86ZAlOqEm5VwC-5y_ndd9wVye4c
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Mercurialgrabber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 12 discord.com 13 discord.com 14 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip4.seeip.org 10 ip-api.com -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1132163375-3267464992-3122396738-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 3288 MicrosoftEdgeUpdate.exe 3288 MicrosoftEdgeUpdate.exe 3288 MicrosoftEdgeUpdate.exe 3288 MicrosoftEdgeUpdate.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1112 skeet.exe Token: SeDebugPrivilege 2696 taskmgr.exe Token: SeSystemProfilePrivilege 2696 taskmgr.exe Token: SeCreateGlobalPrivilege 2696 taskmgr.exe Token: SeDebugPrivilege 3288 MicrosoftEdgeUpdate.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe 2696 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\skeet\skeet.exe"C:\Users\Admin\AppData\Local\Temp\skeet\skeet.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2696
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3100
-
C:\Windows\System32\7wbow6.exe"C:\Windows\System32\7wbow6.exe"1⤵PID:1572
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3288
-
C:\Windows\System32\7wbow6.exe"C:\Windows\System32\7wbow6.exe"1⤵PID:2184
-
C:\Windows\System32\7wbow6.exe"C:\Windows\System32\7wbow6.exe"1⤵PID:3988
-
C:\Windows\System32\7wbow6.exe"C:\Windows\System32\7wbow6.exe"1⤵PID:4840
-
C:\Windows\System32\7wbow6.exe"C:\Windows\System32\7wbow6.exe"1⤵PID:3164
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1