Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
07/09/2022, 09:38
General
- Target bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece.exe
- Size 100KB
- Sample220907-lmjv2abfb6
- SHA256 bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece
Score
10/10
Malware Config
Extracted
Family
-
blackguard
C2
-
https://blguard.shop/
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece.exe"C:\Users\Admin\AppData\Local\Temp\bbc8ac47d3051fbab328d4a8a4c1c8819707ac045ab6ac94b1997dac59be2ece.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4176 -s 17322⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 408 -p 4176 -ip 41761⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4176-132-0x000001B5F6990000-0x000001B5F69B0000-memory.dmp
memory/4176-133-0x00007FFD0A740000-0x00007FFD0B201000-memory.dmp
memory/4176-134-0x00007FFD0A740000-0x00007FFD0B201000-memory.dmp
memory/4176-135-0x00007FFD0A740000-0x00007FFD0B201000-memory.dmp