Analysis
- max time kernel
128s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
06/03/2022, 12:39
Static task
static1
Behavioral task
behavioral1
Sample
rtyDtrtfgass.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
rtyDtrtfgass.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target rtyDtrtfgass.exe
- Size 964KB
- Sample220306-pvmhnsaec8
- SHA256 352c936eaf45ffd2f99ba2a9e726eaa39af29d4c37a6ad5106849f07aa35896c
- MD5 76f95035b61727eb2a4719781b163b04
- SHA1 9571a8e284753f13c058d56d097ddb5b6d3555ea
- SHA512 dc5766aff3997f7e48886f5b47c0759eaa0972aa5a3f90405703366bfecafc0f99c4e762e108c021892345d0181f3c3aed705b0aff09ab788b56f1a193efc035
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
blackguard
C2
-
https://api.telegram.org/bot1840568117:AAGlvKQeSfXkObSE7__yYc5jM9o8qSrkFUw/sendMessage?chat_id=1039923904
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 api.ipify.org 12 api.ipify.org 13 ip-api.com - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 rtyDtrtfgass.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rtyDtrtfgass.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe 664 rtyDtrtfgass.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 664 rtyDtrtfgass.exe