Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250217-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250217-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    07/03/2025, 18:41

General

  • Target

    RGF-main/RBF.exe

  • Size

    41KB

  • MD5

    09d12c328c88bfdfef9dcc0927dca671

  • SHA1

    4f61a36bc05dbd9229b56db5ead4ea3d37e4308a

  • SHA256

    64e772d1da472d9da1dde4d9b070c1d9acf98d9819ec04058a0161f020022e49

  • SHA512

    4774119f1eb6f3f712fc29f7c7cceb31a67c62c01a6b7f09ccf17a85a4d78b3fed4f3a9532c353490f9058aae5db58d305a92a65a8e8039e7c123f48e73d1d51

  • SSDEEP

    768:escGoAxWdPN+wauZLePWTjZKZKfgm3Ehpe:tcVdPN9ePWTVF7Ebe

Malware Config

Extracted

Family

mercurialgrabber

C2

https://discord.com/api/webhooks/975244014364270683/FZnH_sfT1E7Axl_7pfCffp86xK6BWVM_UXXb74CN2p4kpHxH_6kuQsuzlglxNPVfnIm6

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\RGF-main\RBF.exe
    "C:\Users\Admin\AppData\Local\Temp\RGF-main\RBF.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Maps connected drives based on registry
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    PID:3848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3848-0-0x00007FF871E43000-0x00007FF871E45000-memory.dmp

    Filesize

    8KB

  • memory/3848-1-0x0000000000A90000-0x0000000000AA0000-memory.dmp

    Filesize

    64KB

  • memory/3848-2-0x00007FF871E40000-0x00007FF872902000-memory.dmp

    Filesize

    10.8MB

  • memory/3848-3-0x00007FF871E43000-0x00007FF871E45000-memory.dmp

    Filesize

    8KB

  • memory/3848-4-0x00007FF871E40000-0x00007FF872902000-memory.dmp

    Filesize

    10.8MB

  • memory/3848-5-0x00007FF871E40000-0x00007FF872902000-memory.dmp

    Filesize

    10.8MB