Overview
overview
10Static
static
10Mercurial_...al.exe
windows7-x64
7Mercurial_...al.exe
windows10-2004-x64
7Mercurial_...al.exe
windows7-x64
7Mercurial_...al.exe
windows10-2004-x64
7Mercurial_...er.vbs
windows7-x64
1Mercurial_...er.vbs
windows10-2004-x64
1Mercurial_...es.vbs
windows7-x64
1Mercurial_...es.vbs
windows10-2004-x64
1Mercurial_...Gcm.js
windows7-x64
3Mercurial_...Gcm.js
windows10-2004-x64
3Mercurial_...ser.js
windows7-x64
3Mercurial_...ser.js
windows10-2004-x64
3Mercurial_...mon.js
windows7-x64
3Mercurial_...mon.js
windows10-2004-x64
3Mercurial_...ber.js
windows7-x64
3Mercurial_...ber.js
windows10-2004-x64
3Mercurial_...ine.js
windows7-x64
3Mercurial_...ine.js
windows10-2004-x64
3Mercurial_...ram.js
windows7-x64
3Mercurial_...ram.js
windows10-2004-x64
3Mercurial_...ook.js
windows7-x64
3Mercurial_...ook.js
windows10-2004-x64
3Analysis
-
max time kernel
15s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20/03/2025, 21:05
Behavioral task
behavioral1
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Mercurial.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Mercurial.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Properties/Resources.Designer.vbs
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Properties/Resources.Designer.vbs
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Properties/Resources.vbs
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Properties/Resources.vbs
Resource
win10v2004-20250314-en
Behavioral task
behavioral9
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/AesGcm.js
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/AesGcm.js
Resource
win10v2004-20250314-en
Behavioral task
behavioral11
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Browser.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Browser.js
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Common.js
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Common.js
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Grabber.js
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Grabber.js
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Machine.js
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Machine.js
Resource
win10v2004-20250313-en
Behavioral task
behavioral19
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Program.js
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Program.js
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Webhook.js
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Resources/Webhook.js
Resource
win10v2004-20250314-en
General
-
Target
Mercurial_grabber-master/Mercurial-Grabber-master/Mercurial-Grabber-master/Mercurial/Mercurial.exe
-
Size
17.9MB
-
MD5
de3d9bc8e4813084e2c2a8cdebd02d3f
-
SHA1
a416b246e20bbcb37db35b0a4a36b917da34dfd7
-
SHA256
23a9e3fe0e20da93ccf9b8208cc852c5199fc4dc2489276ef0adaefd6a1aa25a
-
SHA512
eaa36e3d73a56e25e8980828db19a0f5bca23664e0d4f652d5f7d11c0552f46142e468ba2df4c59225e93685dad3653c98fa011e7de726bd041626a43a8ac12b
-
SSDEEP
393216:AqPuYXJBft6k/m3pgDOEkSgsvLgf/3Jo:BPuYXJBf0kKlAzgfRo
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1420 Mercurial.exe -
resource yara_rule behavioral3/files/0x000400000001cb39-120.dat upx behavioral3/memory/1420-122-0x000007FEF6A30000-0x000007FEF6E9E000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1936 wrote to memory of 1420 1936 Mercurial.exe 29 PID 1936 wrote to memory of 1420 1936 Mercurial.exe 29 PID 1936 wrote to memory of 1420 1936 Mercurial.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial_grabber-master\Mercurial-Grabber-master\Mercurial-Grabber-master\Mercurial\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial_grabber-master\Mercurial-Grabber-master\Mercurial-Grabber-master\Mercurial\Mercurial.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\Mercurial_grabber-master\Mercurial-Grabber-master\Mercurial-Grabber-master\Mercurial\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial_grabber-master\Mercurial-Grabber-master\Mercurial-Grabber-master\Mercurial\Mercurial.exe"2⤵
- Loads dropped DLL
PID:1420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378