Analysis
-
max time kernel
4294182s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
01-04-2022 04:53
Static task
static1
Behavioral task
behavioral1
Sample
ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe
Resource
win10v2004-20220331-en
General
-
Target
ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe
-
Size
1.5MB
-
MD5
05d3edc56331ce405e49ad2fc4e6c01e
-
SHA1
0b0491f9b654bb0bc41929456ba2943141be6711
-
SHA256
ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14
-
SHA512
b83c1d21147dce1eaadc5d066c0913ab2f08d1a97c34ffb2f4ee685d7f35979c3894b86bd4c2f470c0ae416aac3d9f57fe9d201721bdca2a64fbb9fff7857e26
Malware Config
Extracted
blackguard
https://umpulumpu.ru/
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1992 1388 WerFault.exe 26 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1992 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe 28 PID 1388 wrote to memory of 1992 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe 28 PID 1388 wrote to memory of 1992 1388 ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe"C:\Users\Admin\AppData\Local\Temp\ead17dee70549740a4e649a647516c140d303f507e0c42ac4b6856e6a4ff9e14.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1388 -s 18322⤵
- Program crash
PID:1992
-