Analysis
-
max time kernel
116s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
10-02-2023 04:23
General
-
Target
14ede774e446bd81d52ceae68a78e6b115763e84c1d70651b3db8fdee3243790.exe
-
Size
7.7MB
-
MD5
d4b9dbe7918e420a1393bbe863e2c977
-
SHA1
0f476f47df1d5cc5f904c037776b181b5a7f6d4d
-
SHA256
14ede774e446bd81d52ceae68a78e6b115763e84c1d70651b3db8fdee3243790
-
SHA512
116c48971962dcfa46de87e486743fdedd2ea49e118ec9ce00bb43dc2a8723b102619ab36eff02c34de0f844991ed2cc5851a5f1b3112479984f2d7d646759e6
-
SSDEEP
98304:tyaKXumYgcpmPjN3VJR9G81w3Wis2hTNuSZTKA0t9FFPEpmiYVrsk9N8ivyhAdsM:t5KmgmmPjE+AVbk9fcGVN8iNISWK7
Score
10/10
Malware Config
Extracted
Family
blackguard
C2
https://ldiablopatronum.shop
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Program crash 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14ede774e446bd81d52ceae68a78e6b115763e84c1d70651b3db8fdee3243790.exe"C:\Users\Admin\AppData\Local\Temp\14ede774e446bd81d52ceae68a78e6b115763e84c1d70651b3db8fdee3243790.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3824 -s 20202⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 460 -p 3824 -ip 38241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB