blackguard | 594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f

Analysis

Target

594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe
Size

522KB
MD5

1fd7eb65dad25aea119bd87f8d2318e6
SHA1

22678f48b00df28676210a6c6df88329e5378673
SHA256

594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f
SHA512

015a422d05682750e05047231e4049002265733cebf8120624ba16f591541dd07b6d6d5e192c357ab807d990389c31dbb5eee619cd4c73b3850cc2fbb86ab791

Score

10^/10

Family

blackguard

https://api.telegram.org/bot1181007727:AAFOGOUZ_8YdXsZX1oMgQcNk6d5Kf87AP60/sendMessage?chat_id=553060588

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3640	1996	WerFault.exe	79

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe
1996	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe

C:\Users\Admin\AppData\Local\Temp\594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe
"C:\Users\Admin\AppData\Local\Temp\594871034a21bd98b9cfc059a07a9da3bf37b615c5dda3475ea764ec5c17e12f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1996 -s 772
  2⤵
  - Program crash
  PID:3640

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 1996 -ip 1996
1⤵
PID:3376

memory/1996-130-0x0000000000C10000-0x0000000000C98000-memory.dmp

Filesize
544KB

Download
memory/1996-131-0x00007FFC895A0000-0x00007FFC8A061000-memory.dmp

Filesize
10.8MB

Download