mercurialgrabber | 8694257c04deed3937833145954c65564627f7d40cd20f8401696933a03b7e3f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
18-05-2024 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Celesty.exe
Size

1.7MB
MD5

8966d25141f5e150ff7d02ac502cce46
SHA1

f882485d1ffac1b75b60794824b771e4ce33d7b7
SHA256

8694257c04deed3937833145954c65564627f7d40cd20f8401696933a03b7e3f
SHA512

caedef6e8fdc042d6586816bdc87c36b3d40c22a8e4e331d46296b669ed03f2e295f4b44ed4092f43e8d0dad8cc40766982d6938d1d638fb4e4eecaddd529df3
SSDEEP

49152:6PxCjaDpascfyHTtgWc79pGvFog9hlQ0xM7QYeYnUgy:mCq4sokTtlPFooQzzU/

Score

10^/10

mercurialgrabber evasion spyware stealer

Malware Config

Extracted

Family

mercurialgrabber

https://discord.com/api/webhooks/935223250571640882/ViB43kUXE9CCFxm2v1jxJfLyHYVNk3Y3-laU94OpWmJjw7id0TwbDJUP1by4-O7zvfZu

Signatures

Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
stealer mercurialgrabber
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

CELESTY BUILDER.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions CELESTY BUILDER.EXE
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

CELESTY BUILDER.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools CELESTY BUILDER.EXE
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

CELESTY BUILDER.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion CELESTY BUILDER.EXE
Executes dropped EXE 2 IoCs

Processes:

CelestyBuilder.exeCELESTY BUILDER.EXE

pid process

1160 CelestyBuilder.exe
2612 CELESTY BUILDER.EXE
Loads dropped DLL 3 IoCs

Processes:

Celesty.exeCelestyBuilder.exe

pid process

2416 Celesty.exe
2416 Celesty.exe
1160 CelestyBuilder.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

8 discord.com
9 discord.com
10 discord.com
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ip-api.com
4 ip4.seeip.org
5 ip4.seeip.org

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	CELESTY BUILDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	CELESTY BUILDER.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	CELESTY BUILDER.EXE

pid	process
1160	CelestyBuilder.exe
2612	CELESTY BUILDER.EXE

pid	process
2416	Celesty.exe
2416	Celesty.exe
1160	CelestyBuilder.exe

flow	ioc
8	discord.com
9	discord.com
10	discord.com

flow	ioc
6	ip-api.com
4	ip4.seeip.org
5	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

CELESTY BUILDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	CELESTY BUILDER.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	CELESTY BUILDER.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

CELESTY BUILDER.EXE

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S CELESTY BUILDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	CELESTY BUILDER.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CELESTY BUILDER.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	CELESTY BUILDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CELESTY BUILDER.EXE

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

CELESTY BUILDER.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	CELESTY BUILDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	CELESTY BUILDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	CELESTY BUILDER.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	CELESTY BUILDER.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

CELESTY BUILDER.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	CELESTY BUILDER.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	CELESTY BUILDER.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

CELESTY BUILDER.EXE

description pid process

Token: SeDebugPrivilege 2612 CELESTY BUILDER.EXE

description	pid	process
Token: SeDebugPrivilege	2612	CELESTY BUILDER.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

Celesty.exeCelestyBuilder.exeCELESTY BUILDER.EXE

description	pid	process	target process
PID 2416 wrote to memory of 1160	2416	Celesty.exe	CelestyBuilder.exe
PID 2416 wrote to memory of 1160	2416	Celesty.exe	CelestyBuilder.exe
PID 2416 wrote to memory of 1160	2416	Celesty.exe	CelestyBuilder.exe
PID 2416 wrote to memory of 1160	2416	Celesty.exe	CelestyBuilder.exe
PID 1160 wrote to memory of 2612	1160	CelestyBuilder.exe	CELESTY BUILDER.EXE
PID 1160 wrote to memory of 2612	1160	CelestyBuilder.exe	CELESTY BUILDER.EXE
PID 1160 wrote to memory of 2612	1160	CelestyBuilder.exe	CELESTY BUILDER.EXE
PID 1160 wrote to memory of 2612	1160	CelestyBuilder.exe	CELESTY BUILDER.EXE
PID 1160 wrote to memory of 2676	1160	CelestyBuilder.exe	CELESTY.EXE
PID 1160 wrote to memory of 2676	1160	CelestyBuilder.exe	CELESTY.EXE
PID 1160 wrote to memory of 2676	1160	CelestyBuilder.exe	CELESTY.EXE
PID 1160 wrote to memory of 2676	1160	CelestyBuilder.exe	CELESTY.EXE
PID 2612 wrote to memory of 2260	2612	CELESTY BUILDER.EXE	WerFault.exe
PID 2612 wrote to memory of 2260	2612	CELESTY BUILDER.EXE	WerFault.exe
PID 2612 wrote to memory of 2260	2612	CELESTY BUILDER.EXE	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\Celesty.exe
"C:\Users\Admin\AppData\Local\Temp\Celesty.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe
"C:\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE
"C:\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE"
3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2612 -s 1748
4⤵
PID:2260

C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE
"C:\Users\Admin\AppData\Local\Temp\CELESTY.EXE"
3⤵
PID:2676

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\CELESTY BUILDER.EXE
Filesize
41KB

MD5
4cc81e53b9037673b9014431e9be0e60

SHA1
62c57cbad6be321e65bea71bd87801fcb0bf7af9

SHA256
1baf3f560a47aacd9a841939ff127fbade26095dd47867dfec38bc2f1fa4a9ad

SHA512
dae96f885d20fe185302f689f844032797209b28d1295444a29fa730d01b520e7994121fe8bd2b55c0d21b395da372a9846d9dec5960edfecd40ac41690d36ff

Download Submit
\Users\Admin\AppData\Roaming\dump\CelestyBuilder.exe
Filesize
2.8MB

MD5
d604d3ac515faf6ad32e8e57c170d389

SHA1
02069909d405b33af28da67ad232013307a198b2

SHA256
5d3955502a6b63e394eea67aad6c83dfa80d08484d9f11956e77ec5b47c6f8b8

SHA512
bb1d77a7430204eef2ecb3cdfb7d2b2b5f80f9f5fefee6cbff2fc69538523177e8010d9dc4b353f4adc4c6bdba2c398ceac90ce43a1302b2cdf5149dd7680817

Download Submit
memory/2416-0-0x0000000074A51000-0x0000000074A52000-memory.dmp

Filesize
4KB

Download
memory/2416-1-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/2416-2-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/2416-17-0x0000000074A50000-0x0000000074FFB000-memory.dmp

Filesize
5.7MB

Download
memory/2612-19-0x0000000001060000-0x0000000001070000-memory.dmp

Filesize
64KB

Download