Resubmissions
10/08/2026, 01:07
260810-bgq22sgn5z1010/08/2026, 00:51
260810-a7t1ysgl3x1006/03/2026, 20:12
260306-yyxmgsdw9r1006/03/2026, 19:54
260306-ymst6adv2m1006/03/2026, 02:15
260306-cp2n7afx5x10Analysis
- max time kernel
149s - max time network
92s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/03/2026, 02:15
General
- Target Mercurial.exe
- Size 3.2MB
- Sample260306-cp2n7afx5x
- SHA256 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5036-0-0x0000000000A70000-0x0000000000DAA000-memory.dmp
memory/5036-1-0x0000000005F20000-0x00000000064C6000-memory.dmp
memory/5036-2-0x00000000058A0000-0x0000000005932000-memory.dmp
memory/5036-3-0x0000000005960000-0x0000000005970000-memory.dmp
memory/5036-4-0x0000000005860000-0x000000000586A000-memory.dmp
memory/5036-6-0x0000000005940000-0x0000000005960000-memory.dmp
memory/5036-5-0x0000000005870000-0x000000000588C000-memory.dmp
memory/5036-7-0x0000000005AB0000-0x0000000005AD0000-memory.dmp
memory/5036-8-0x0000000005AF0000-0x0000000005B00000-memory.dmp
memory/5036-9-0x0000000005B00000-0x0000000005B14000-memory.dmp
memory/5036-10-0x0000000005C20000-0x0000000005C8E000-memory.dmp
memory/5036-11-0x0000000005C90000-0x0000000005CAE000-memory.dmp
memory/5036-12-0x0000000005CD0000-0x0000000005D06000-memory.dmp
memory/5036-13-0x0000000005D10000-0x0000000005D1E000-memory.dmp
memory/5036-14-0x0000000005D30000-0x0000000005D3E000-memory.dmp
memory/5036-15-0x00000000066A0000-0x00000000067EA000-memory.dmp
memory/5036-16-0x0000000006850000-0x0000000006966000-memory.dmp
memory/5036-17-0x0000000005EB0000-0x0000000005EE0000-memory.dmp
memory/5036-18-0x0000000007AC0000-0x0000000007AC8000-memory.dmp
memory/5036-19-0x0000000005960000-0x0000000005970000-memory.dmp
memory/5036-20-0x0000000005960000-0x0000000005970000-memory.dmp
memory/5036-21-0x0000000005960000-0x0000000005970000-memory.dmp
memory/5036-22-0x0000000005960000-0x0000000005970000-memory.dmp
memory/5036-23-0x0000000005970000-0x0000000005A31000-memory.dmp
memory/5036-24-0x0000000005960000-0x0000000005970000-memory.dmp
memory/5036-25-0x0000000005960000-0x0000000005970000-memory.dmp
memory/5036-26-0x0000000005960000-0x0000000005970000-memory.dmp