Analysis
- max time kernel
49s - max time network
71s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
01/04/2022, 04:56
General
- Target bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece.exe
- Size 100KB
- Sample220401-fk14msede7
- SHA256 bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece
Score
10/10
Malware Config
Extracted
Family
-
blackguard
C2
-
https://blguard.shop/
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece.exe"C:\Users\Admin\AppData\Local\Temp\bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4992 -s 17282⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4992 -ip 49921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4992-124-0x0000020CAEDC0000-0x0000020CAEDE0000-memory.dmp
memory/4992-125-0x00007FFA95650000-0x00007FFA96111000-memory.dmp
memory/4992-126-0x0000020CC9CA0000-0x0000020CC9CA2000-memory.dmp