Analysis
- max time kernel
90s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
06/03/2022, 11:57
General
- Target Leane.exe
- Size 3.9MB
- Sample220306-n4k6jacbfq
- SHA256 ba2bc430c4661aab84cf7e8fedf2684e5fc106f7797af4553aef7490193b00a6
Score
10/10
Malware Config
Extracted
Family
-
blackguard
C2
-
https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Leane.exe"C:\Users\Admin\AppData\Local\Temp\Leane.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3968 -s 15522⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 428 -p 3968 -ip 39681⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3968-130-0x00000217DCA90000-0x00000217DCE88000-memory.dmp
memory/3968-131-0x00007FFE676E0000-0x00007FFE681A1000-memory.dmp
memory/3968-132-0x00000217F8B50000-0x00000217F8B52000-memory.dmp
memory/3968-133-0x00000217FAC20000-0x00000217FAC70000-memory.dmp
memory/3968-134-0x00000217F8EC0000-0x00000217F8EE2000-memory.dmp