mercury_loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
mercury_loader.exe
Size 891KB
Sample261029-xp4trssx7r
SHA256 3fbda8b3c62d1023d3e98ca45d2788ec9315fdb86a2730b8e986d1324a021c1a
MD5 717a57dc71cbddcf463acc2f8c816354
SHA1 30226609c78c0f6cecc14733c20290e1a5f654a8
SHA512 5608c6b142663ee1936dc9883cc410b722b4badfd9b0ddb87a9b9acbc7e8fa8ed84071970fb8ba653e79dc6997c1debb213041ad486e2c9bd563bf369b4eb934
SSDEEP 24576:8r9IiLQcYPgpxGMRexJyyTIqbo9qiRnAzS:uIWQ70IMAbrc9zRn+
TLSH
T15D15BF59F2B901F9D07BE138D996A60BEA723849076089DB13D445993FB33F05BBB312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mercury_loader.exe

File Explorer

mercury_loader.exe

.exe 891KB

mercury_loader.exe

IMPHASH c097676dbe011fdac349be7eda989741
SHA256 3fbda8b3c62d1023d3e98ca45d2788ec9315fdb86a2730b8e986d1324a021c1a
MD5 717a57dc71cbddcf463acc2f8c816354
SHA1 30226609c78c0f6cecc14733c20290e1a5f654a8
SHA512 5608c6b142663ee1936dc9883cc410b722b4badfd9b0ddb87a9b9acbc7e8fa8ed84071970fb8ba653e79dc6997c1debb213041ad486e2c9bd563bf369b4eb934
SSDEEP 24576:8r9IiLQcYPgpxGMRexJyyTIqbo9qiRnAzS:uIWQ70IMAbrc9zRn+
TLSH
T15D15BF59F2B901F9D07BE138D996A60BEA723849076089DB13D445993FB33F05BBB312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

491088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

shell32

SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree

kernel32

CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess CreateRemoteThread OpenProcess GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleA GetProcAddress LocalFree FormatMessageW GetComputerNameW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose IsDebuggerPresent GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetFilePointerEx ReadConsoleW GetConsoleMode HeapReAlloc LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread WriteFile SetFilePointer ReadFile GetVolumeInformationW GetFileAttributesW DeleteFileW CreateFileW CreateDirectoryW SetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError GetStringTypeW RtlUnwind HeapSize SetEndOfFile CheckRemoteDebuggerPresent RtlUnwindEx RaiseException WriteConsoleW WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader

user32

TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetWindowPos GetSystemMetrics ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard UpdateWindow SetClipboardData CloseClipboard OpenClipboard GetCursorPos GetWindowRect GetForegroundWindow GetActiveWindow SetWindowDisplayAffinity SetProcessDpiAwarenessContext GetDpiForWindow LoadCursorW GetDesktopWindow MessageBoxW GetClipboardData

advapi32

RegGetValueW OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3dcompiler_47

D3DCompile

Name

.text

Size

640KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mercury_loader.exe

d3d11

shell32

ole32

kernel32

user32

advapi32

winhttp

imm32

d3dcompiler_47

generic