Overview

overview

10

Static

static

10

cleaner.exe

windows7_x64

10

cleaner.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    137s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    06-03-2022 12:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cleaner.exe

  • Size

    2.6MB

  • MD5

    ff8969d4de3b577608c602242d1caa06

  • SHA1

    150b893f1b1a8ffefdbcea281bf33fa444c7a46f

  • SHA256

    18db274624914ee6388bda20233db28307be4873bc053e05ad8f6761b217136f

  • SHA512

    02282eae328f02d18f22620b83fb0e4b4202e61a4243fbcc1064ed75c39f87fe3706f22f7b551da3154461e13b4bb6dcbdbaaf2c231cb5234881f60a7366cab9

Score
10/10
blackguardspywarestealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904

Signatures

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard
  • Downloads MZ/PE file
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cleaner.exe
    "C:\Users\Admin\AppData\Local\Temp\cleaner.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:212
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 212 -s 2268
      2⤵
      • Program crash
      PID:1588
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 436 -p 212 -ip 212
    1⤵
      PID:2292

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Web Service

    1
    T1102

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\x64\SQLite.Interop.dll
      MD5

      616827a61d7a49ce5389c5d96443e35d

      SHA1

      d522ee5607e122e775d77641dba09711146db739

      SHA256

      54d4025bc175de5367d0ace1a78fec7edf06b642892691cf85afb02b8ab166d5

      SHA512

      fd6a53cb9851e56b8dc6a40627058852f2949688b73dacf6f3e0fcf932453b8c52a3bfefb12c80c38397a89f1038ad8fad329ea2798b86457ce5d8fe7ba87312

      Download Submit
    • memory/212-133-0x000001E3007C0000-0x000001E300A64000-memory.dmp
      Filesize

      2.6MB

      Download
    • memory/212-134-0x00007FFC116F0000-0x00007FFC121B1000-memory.dmp
      Filesize

      10.8MB

      Download
    • memory/212-135-0x000001E31C580000-0x000001E31C582000-memory.dmp
      Filesize

      8KB

      Download
    • memory/212-136-0x000001E31EBD0000-0x000001E31EC20000-memory.dmp
      Filesize

      320KB

      Download
    • memory/212-137-0x000001E31C590000-0x000001E31C5B2000-memory.dmp
      Filesize

      136KB

      Download