Analysis
-
max time kernel
446s -
max time network
448s -
platform
windows10-ltsc_2021_x64 -
resource
win10ltsc2021-20250314-en -
resource tags
-
submitted
26/03/2025, 20:55
General
-
Target
Idk.exe
-
Size
42KB
-
MD5
e7741c044277fa3f4393a24f448e660a
-
SHA1
4487b368b2902900f180c73218e504b28e83fd88
-
SHA256
408d19e52f4bf6ab8faeb03b1a93d08d7293e10e741d1de59e716627a72733b1
-
SHA512
45e77b4ae7355d843b9cf73a408e97d3cd7589372ceefa837580c29a8c545e7f9378740163a1f145f717aa19600d3142ccf16335ba4911062e11c0f6f88e89a8
-
SSDEEP
768:ZqFK330/XSN1uZNLRPTjFKZKfgm3Eh12:AFi2LRPThF7EP2
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1354559012762419201/AotG8pZ98gkWzZZIX4L-2HwFSt0dJ9rzFV3ZyhStumXho43elLmsGAcsrN1zS6tMTvc5
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Mercurialgrabber family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Idk.exe"C:\Users\Admin\AppData\Local\Temp\Idk.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB