Resubmissions
10/08/2026, 01:07
260810-bgq22sgn5z1010/08/2026, 00:51
260810-a7t1ysgl3x1006/03/2026, 20:12
260306-yyxmgsdw9r1006/03/2026, 19:54
260306-ymst6adv2m1006/03/2026, 02:15
260306-cp2n7afx5x10Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 00:51
General
- Target Mercurial.exe
- Size 3.2MB
- Sample260810-a7t1ysgl3x
- SHA256 890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
Malware Config
Signatures
- Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1236-0-0x00000000741F2000-0x00000000741F3000-memory.dmp
memory/1236-1-0x00000000003C0000-0x00000000006FA000-memory.dmp
memory/1236-2-0x0000000005760000-0x0000000005D1A000-memory.dmp
memory/1236-3-0x0000000005240000-0x00000000052D2000-memory.dmp
memory/1236-4-0x0000000005230000-0x000000000523A000-memory.dmp
memory/1236-5-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-6-0x0000000005360000-0x000000000537C000-memory.dmp
memory/1236-10-0x00000000053F0000-0x0000000005404000-memory.dmp
memory/1236-12-0x0000000005480000-0x000000000549E000-memory.dmp
memory/1236-11-0x0000000005400000-0x000000000546E000-memory.dmp
memory/1236-9-0x00000000053E0000-0x00000000053F0000-memory.dmp
memory/1236-8-0x00000000053A0000-0x00000000053C0000-memory.dmp
memory/1236-7-0x0000000005380000-0x00000000053A0000-memory.dmp
memory/1236-15-0x0000000005520000-0x000000000552E000-memory.dmp
memory/1236-14-0x0000000005500000-0x000000000550E000-memory.dmp
memory/1236-13-0x00000000054C0000-0x00000000054F6000-memory.dmp
memory/1236-16-0x0000000006A50000-0x0000000006B9A000-memory.dmp
memory/1236-17-0x0000000006BA0000-0x0000000006CB6000-memory.dmp
memory/1236-18-0x00000000056A0000-0x00000000056D0000-memory.dmp
memory/1236-19-0x00000000099C0000-0x00000000099C8000-memory.dmp
memory/1236-20-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-21-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-22-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-23-0x00000000741F2000-0x00000000741F3000-memory.dmp
memory/1236-24-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-25-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-26-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-27-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-28-0x00000000741E0000-0x000000007499C000-memory.dmp
memory/1236-29-0x00000000741E0000-0x000000007499C000-memory.dmp