blackguard | a49fd25b00e8ef3240caec0ccb08d0f0da1e4b5779f611c030df80b13f7ead11 | Triage

Analysis

max time kernel
4294181s
max time network
124s
platform
windows7_x64
resource
win7-20220311-en
submitted
01-04-2022 05:01

Sharing

Report Analysis Logs

General

Target

1388-55-0x0000000000B70000-0x0000000000BC4000-memory.exe
Size

336KB
MD5

c9d522b650a08a5ac3374240cd7e4da3
SHA1

dc0b9124cad566be7b5e65f2528d8300b1040007
SHA256

a49fd25b00e8ef3240caec0ccb08d0f0da1e4b5779f611c030df80b13f7ead11
SHA512

b2e84b9bd22165307deb188695be15252c3974633c054d6ef9dd908f956f7564d48a62760f70c1fbfed5d25cd32d5bf0c6085025340b1e89fe4da6b8446a164f

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

C2

https://umpulumpu.ru/

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1712	1044	WerFault.exe	26

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	1388-55-0x0000000000B70000-0x0000000000BC4000-memory.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 1712	1044	1388-55-0x0000000000B70000-0x0000000000BC4000-memory.exe	28
PID 1044 wrote to memory of 1712	1044	1388-55-0x0000000000B70000-0x0000000000BC4000-memory.exe	28
PID 1044 wrote to memory of 1712	1044	1388-55-0x0000000000B70000-0x0000000000BC4000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\1388-55-0x0000000000B70000-0x0000000000BC4000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1388-55-0x0000000000B70000-0x0000000000BC4000-memory.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1044 -s 1792
  2⤵
  - Program crash
  PID:1712

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1044-54-0x0000000000FF0000-0x0000000001044000-memory.dmp

Filesize
336KB

Download
memory/1044-55-0x000000001AAB0000-0x000000001AAB2000-memory.dmp

Filesize
8KB

Download