blackguard | 62485717db5c9c62cedeb912e22dc450207482f0df309ed6f14ddf3c7858b36f | Triage

Analysis

max time kernel
4294183s
max time network
127s
platform
windows7_x64
resource
win7-20220310-en
submitted
01-04-2022 05:04

Sharing

Report Analysis Logs

General

Target

624-55-0x0000000000960000-0x00000000009B4000-memory.exe
Size

336KB
MD5

20c5b4f94aff5e6a72450a83bc7657a0
SHA1

eb219c1ece50f73ee79a792a533bd421c509133e
SHA256

62485717db5c9c62cedeb912e22dc450207482f0df309ed6f14ddf3c7858b36f
SHA512

c78ffd5259123d688fce7d50d480ddf810a07962762b5034ce2afa43d8188d87a14875ed4b90dae339c64e6cdaff55190da15eb6c7b6acc6b13decd3386233d4

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

C2

https://win.mirtonewbacker.com/

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1984	536	WerFault.exe	23

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	536	624-55-0x0000000000960000-0x00000000009B4000-memory.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 1984	536	624-55-0x0000000000960000-0x00000000009B4000-memory.exe	30
PID 536 wrote to memory of 1984	536	624-55-0x0000000000960000-0x00000000009B4000-memory.exe	30
PID 536 wrote to memory of 1984	536	624-55-0x0000000000960000-0x00000000009B4000-memory.exe	30

C:\Users\Admin\AppData\Local\Temp\624-55-0x0000000000960000-0x00000000009B4000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\624-55-0x0000000000960000-0x00000000009B4000-memory.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 536 -s 744
  2⤵
  - Program crash
  PID:1984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/536-54-0x00000000002E0000-0x0000000000334000-memory.dmp

Filesize
336KB

Download
memory/536-55-0x000000001BA00000-0x000000001BA02000-memory.dmp

Filesize
8KB

Download