Overview
overview
10Static
static
107a78d3faa8...c0.exe
windows7-x64
107a78d3faa8...c0.exe
windows10-2004-x64
107a8104b16e...22.exe
windows7-x64
107a8104b16e...22.exe
windows10-2004-x64
107ab705f224...05.exe
windows7-x64
107ab705f224...05.exe
windows10-2004-x64
107adc287e95...c9.exe
windows7-x64
107adc287e95...c9.exe
windows10-2004-x64
107afc023a5e...1f.exe
windows7-x64
107afc023a5e...1f.exe
windows10-2004-x64
107b5101c912...dd.exe
windows7-x64
107b5101c912...dd.exe
windows10-2004-x64
107b545826d4...54.exe
windows7-x64
107b545826d4...54.exe
windows10-2004-x64
107b61ae4f03...92.exe
windows7-x64
107b61ae4f03...92.exe
windows10-2004-x64
107b7c0c824b...52.exe
windows7-x64
107b7c0c824b...52.exe
windows10-2004-x64
107b9f7b540f...84.exe
windows7-x64
77b9f7b540f...84.exe
windows10-2004-x64
77c24c0692a...ea.exe
windows7-x64
107c24c0692a...ea.exe
windows10-2004-x64
107c2f113ba8...fb.exe
windows7-x64
107c2f113ba8...fb.exe
windows10-2004-x64
107c8b7f048d...3e.exe
windows7-x64
107c8b7f048d...3e.exe
windows10-2004-x64
107ca42dc286...36.exe
windows7-x64
107ca42dc286...36.exe
windows10-2004-x64
107ce67df193...f2.exe
windows7-x64
107ce67df193...f2.exe
windows10-2004-x64
107cebdbe487...1d.exe
windows7-x64
77cebdbe487...1d.exe
windows10-2004-x64
7Analysis
-
max time kernel
104s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20250313-en -
resource tags
arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2025, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
7a78d3faa8bb1e60b3300959a55559c0.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7a78d3faa8bb1e60b3300959a55559c0.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral3
Sample
7a8104b16eebe51954a83ce3ee440b125476d3222314a3cbba247ddf77d62b22.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
7a8104b16eebe51954a83ce3ee440b125476d3222314a3cbba247ddf77d62b22.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral5
Sample
7ab705f224e5e7c9426f8602ace00f05.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
7ab705f224e5e7c9426f8602ace00f05.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral7
Sample
7adc287e958d5eb62246c2714f59cec9.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
7adc287e958d5eb62246c2714f59cec9.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral9
Sample
7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe
Resource
win10v2004-20250313-en
Behavioral task
behavioral11
Sample
7b5101c9122edf393eb01ae2e8376ff4c068ae90480c777e1d5e671b2d2b61dd.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
7b5101c9122edf393eb01ae2e8376ff4c068ae90480c777e1d5e671b2d2b61dd.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral13
Sample
7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
7b545826d4c80e7dc461ebae6c6dd9a3ddadec34a907d988744a485390bd6d54.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral15
Sample
7b61ae4f030c2ff2d514149d23e413fd0ca5044e4330887faebb33446b4e4792.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
7b61ae4f030c2ff2d514149d23e413fd0ca5044e4330887faebb33446b4e4792.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral17
Sample
7b7c0c824b8d7f5dcd61ecd49ef48352.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
7b7c0c824b8d7f5dcd61ecd49ef48352.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral19
Sample
7b9f7b540f1d1f808cab1b3a24e97d84.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
7b9f7b540f1d1f808cab1b3a24e97d84.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral21
Sample
7c24c0692aeb64f8cab8de418247bdea.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
7c24c0692aeb64f8cab8de418247bdea.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral23
Sample
7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
7c2f113ba8a501582e5be7ba0c0bf0fb.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral25
Sample
7c8b7f048ddf08182db2824fff38e73e.exe
Resource
win7-20250207-en
Behavioral task
behavioral26
Sample
7c8b7f048ddf08182db2824fff38e73e.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral27
Sample
7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
7ca42dc286ca99ecb75ab26cc68042f04556b199feb0ecdece718faf13b8de36.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral29
Sample
7ce67df193db91ca606ca62cfd5ffef2.exe
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
7ce67df193db91ca606ca62cfd5ffef2.exe
Resource
win10v2004-20250314-en
Behavioral task
behavioral31
Sample
7cebdbe487a669e8a1bbd5c09ed5721d.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
7cebdbe487a669e8a1bbd5c09ed5721d.exe
Resource
win10v2004-20250314-en
General
-
Target
7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe
-
Size
274KB
-
MD5
9aca6f714263d9782126c97d7e0b06e1
-
SHA1
83164afc9af65f2bbac9f11104cd749a0ce4cb38
-
SHA256
7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f
-
SHA512
64d2e0e004e5b767d5b92e5ddc5bdf0c2629b2457ea3e1371999db2b1a38329892dfd120d10579ffc41ec3db92043c80c8435b709791d421f3e6b18d6080a2c4
-
SSDEEP
1536:Jc1C0eQWT+F7EIiXS0UUwfW4Yb/uE7SDhOaa:61ve5T+F7Eri0UUwfW4Yb/uE7SDhOaa
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1288901667378696305/Ld3vx4JK5uthMQySWRKj1BbYyngn7jZHuyKNgQFZYluhp1VI2lWyMrfi3zxaVADYWM2s
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Mercurialgrabber family
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
flow ioc 41 discord.com 43 discord.com 44 discord.com 36 discord.com 37 discord.com 38 discord.com 40 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 ip-api.com 3 ip4.seeip.org -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1932 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1932 7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe"C:\Users\Admin\AppData\Local\Temp\7afc023a5e75b3afa7bbb2091a6170dbc3c895858f38ee5016dc1fa63e71a41f.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1