blackguard | 62485717db5c9c62cedeb912e22dc450207482f0df309ed6f14ddf3c7858b36f | Triage

Analysis

max time kernel
70s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
01-04-2022 05:04

Sharing

Report Analysis Logs

General

Target

624-55-0x0000000000960000-0x00000000009B4000-memory.exe
Size

336KB
MD5

20c5b4f94aff5e6a72450a83bc7657a0
SHA1

eb219c1ece50f73ee79a792a533bd421c509133e
SHA256

62485717db5c9c62cedeb912e22dc450207482f0df309ed6f14ddf3c7858b36f
SHA512

c78ffd5259123d688fce7d50d480ddf810a07962762b5034ce2afa43d8188d87a14875ed4b90dae339c64e6cdaff55190da15eb6c7b6acc6b13decd3386233d4

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

C2

https://win.mirtonewbacker.com/

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4808	1496	WerFault.exe	75

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1496	624-55-0x0000000000960000-0x00000000009B4000-memory.exe

C:\Users\Admin\AppData\Local\Temp\624-55-0x0000000000960000-0x00000000009B4000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\624-55-0x0000000000960000-0x00000000009B4000-memory.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1496
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1496 -s 1980
  2⤵
  - Program crash
  PID:4808

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 180 -p 1496 -ip 1496
1⤵
PID:4800

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1496-124-0x0000022AAF8A0000-0x0000022AAF8F4000-memory.dmp

Filesize
336KB

Download
memory/1496-125-0x00007FF9BDE70000-0x00007FF9BE931000-memory.dmp

Filesize
10.8MB

Download
memory/1496-126-0x0000022ACA820000-0x0000022ACA822000-memory.dmp

Filesize
8KB

Download