blackguard | f47db48129530cf19f3c42f0c9f38ce1915f403469483661999dc2b19e12650b

Resubmissions

31/03/2022, 16:03

220331-thnx7aedd210

03/02/2022, 08:05

220203-jyw9dsedhp3

Analysis

max time kernel
4294183s
max time network
129s
platform
windows7_x64
resource
win7-20220310-en
submitted
31/03/2022, 16:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d2f181221ba9049c02ed7283c9144c7c.exe
Size 1.7MB
Sample220331-thnx7aedd2
SHA256 f47db48129530cf19f3c42f0c9f38ce1915f403469483661999dc2b19e12650b
MD5 d2f181221ba9049c02ed7283c9144c7c
SHA1 b4ed1b4714112d5fc3c7b4673e19ed26ae4c6e85
SHA512 ab0b9a029489f6b3a091c7823b5523ea3cfd8677b32eddd48ba7e64694e4146c3292589d9d09bd0cc5908c9d86c830ee21e75f8712e6f3a2cba2cfd853f372a1
MD5 SHA1 SHA512

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

http://funkyjazz.me/

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	1628	WerFault.exe	20

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	d2f181221ba9049c02ed7283c9144c7c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1996	1628	d2f181221ba9049c02ed7283c9144c7c.exe	29
PID 1628 wrote to memory of 1996	1628	d2f181221ba9049c02ed7283c9144c7c.exe	29
PID 1628 wrote to memory of 1996	1628	d2f181221ba9049c02ed7283c9144c7c.exe	29

C:\Users\Admin\AppData\Local\Temp\d2f181221ba9049c02ed7283c9144c7c.exe
"C:\Users\Admin\AppData\Local\Temp\d2f181221ba9049c02ed7283c9144c7c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1628 -s 1268
  2⤵
  - Program crash
  PID:1996

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-54-0x0000000000160000-0x0000000000322000-memory.dmp

Download

memory/1628-55-0x000000001B0A0000-0x000000001B0A2000-memory.dmp