Analysis
-
max time kernel
91s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
06-03-2022 12:43
General
-
Target
Tradingview.exe
-
Size
943KB
-
MD5
f947dd30578a05aaaeeab577cd64343e
-
SHA1
849f02b6a0ffecaef8efcc9bb0be9a6f03c278e0
-
SHA256
918af1137f069eccc04220c280e13ed440a380aa0446cfa1d80b4e0ade6c3528
-
SHA512
00d80ad5bc3f7fef122c3212e3aab819868e7109a21a89478732b728d7cb13e1b0353306835e3eced77db4284d08f8c5036caabead10b6ca41c7d91efdf1c696
Score
10/10
Malware Config
Extracted
Family
blackguard
C2
https://api.telegram.org/bot2088622057:AAHBeaoCOwatBAei8rEaCpsgBnxT3LGE5eM/sendMessage?chat_id=447075298
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tradingview.exe"C:\Users\Admin\AppData\Local\Temp\Tradingview.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
968KB
-
Filesize
7.7MB
-
Filesize
5.6MB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
4KB