blackguard | 26ebf8a0830652c9ea0de64dc0dca6d62caffc0aaa34abf43e7c410095c502ce

Analysis

Target

Leane.exe
Size

4.0MB
MD5

ebf4d78f0035564af1002ddfb5f44d7e
SHA1

ee00172983aed98780ef55cfff7f85084bd627e9
SHA256

26ebf8a0830652c9ea0de64dc0dca6d62caffc0aaa34abf43e7c410095c502ce
SHA512

33e37b1aa1518f69e74ccc736fb9fdfad51d7d69b4685c88edacddea0f3a64ad066ed9daa5d96522583da66e588a636efb6a0d7224441281ac99db865550150b

Score

10^/10

Family

blackguard

https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4716	2752	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	Leane.exe

C:\Users\Admin\AppData\Local\Temp\Leane.exe
"C:\Users\Admin\AppData\Local\Temp\Leane.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2752 -s 1372
  2⤵
  - Program crash
  PID:4716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 416 -p 2752 -ip 2752
1⤵
PID:4180

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

memory/2752-130-0x00000216F4A40000-0x00000216F4E3C000-memory.dmp

Filesize
4.0MB

Download
memory/2752-131-0x00007FFC4E0E0000-0x00007FFC4EBA1000-memory.dmp

Filesize
10.8MB

Download
memory/2752-132-0x00000216F51F0000-0x00000216F51F2000-memory.dmp

Filesize
8KB

Download
memory/2752-133-0x00000216F8E10000-0x00000216F8E60000-memory.dmp

Filesize
320KB

Download
memory/2752-134-0x00000216F8E60000-0x00000216F8E82000-memory.dmp

Filesize
136KB

Download