Analysis
-
max time kernel
4294178s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20220223-en -
submitted
06-03-2022 12:39
Static task
static1
Behavioral task
behavioral1
Sample
rtyDtrtfgass.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
rtyDtrtfgass.exe
Resource
win10v2004-en-20220113
General
-
Target
rtyDtrtfgass.exe
-
Size
964KB
-
MD5
76f95035b61727eb2a4719781b163b04
-
SHA1
9571a8e284753f13c058d56d097ddb5b6d3555ea
-
SHA256
352c936eaf45ffd2f99ba2a9e726eaa39af29d4c37a6ad5106849f07aa35896c
-
SHA512
dc5766aff3997f7e48886f5b47c0759eaa0972aa5a3f90405703366bfecafc0f99c4e762e108c021892345d0181f3c3aed705b0aff09ab788b56f1a193efc035
Malware Config
Extracted
blackguard
https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org 6 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 rtyDtrtfgass.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rtyDtrtfgass.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe 964 rtyDtrtfgass.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 964 rtyDtrtfgass.exe