blackguard | 18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de

General

Target

18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
Size

237KB
MD5

08c1b360ad5f727a0660adfa74bd7509
SHA1

43a8d5a55f858ac67b195d2ebebc4ea498686f38
SHA256

18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de
SHA512

9c80b9f3ef2152e391222fb2a88d3d14d1bdfe6de256cf2659282dcc16cf0ff0d27f82500446c3e7375a481a47d39a0aad3d4f8e805dfe67b8e126c75253cfcd
SSDEEP

3072:L5IAyZvNOYWO3bAfFFHjBl+Bl2K4eqibSE6czFKJLQPeI/Kh73WmqcSCJLeKgh2B:iAyZvHWbTH1l6RDbDjkIpbs

Score

10^/10

blackguard spyware stealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot5973155151:AAGgQ2GQ_WZVdt1bf_ib5JEZozBNQ7N52ww/sendMessage?chat_id=1870895902

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	freegeoip.app
2	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1736	18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
1736	18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
1736	18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
1736	18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe

C:\Users\Admin\AppData\Local\Temp\18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe
"C:\Users\Admin\AppData\Local\Temp\18c5f62d2fff0705013b83fc5c5c09ad7b9faeddac4bf4c8f2b5bb532f9488de.exe"
1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\wuRZZuuLwNuXVPROBKQPFG.Admin\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\wuRZZuuLwNuXVPROBKQPFG.Admin\Process.txt

Filesize
535B

MD5
d09ff212c5ad2e103786f9b8d42cc57d

SHA1
38e37c01d8c33853a708e427710aed9fdce94380

SHA256
ad1d60d7160da040284be561e704e203607de07bae08a70f87ee153f7cbe31a3

SHA512
639f7fd79ef34de329bb29718d5ee1c746e08fa0d9303638d8657d0b76d62b844a06c92ef708df601bb219b1dcb6b8b4995aaab6d7fbb3029c27ac084c967829

Download Submit
C:\Users\Admin\AppData\Roaming\wuRZZuuLwNuXVPROBKQPFG.Admin\Process.txt

Filesize
601B

MD5
25184c9bed249ce3f74633b5921ad91b

SHA1
c92a1302b4e2f048308677909423abee36a7b057

SHA256
228e939ee8437279994d19bb6ee6774ad16b711ba26f202346f8239adacf74f9

SHA512
5098d5d8ee217f665f5621aa4f9511b9d343ca0ede6bf0865ac6ea3156b9e4144af69b2fc91c70c0a94264b6dbc78ab1691c2ad4b5ddfa70f7a343b2d7801384

Download Submit
C:\Users\Admin\AppData\Roaming\wuRZZuuLwNuXVPROBKQPFG.Admin\Process.txt

Filesize
1KB

MD5
c6aad7c4d6194e1524792655460f040f

SHA1
b9f8a986d519d6945a5bee760a48636323b1e9e6

SHA256
52b424870e026b0e21f3e4a7a5783714bacb7f392e68a48c966222fd95aaa447

SHA512
35c2dfbedf8d8c1dd0d4cc79d2ff4c85e1f59ec3967eb130315c19b82d6648ed6c34e1708593ab1381bfa3cee8f9cf98a9abc20a51b265450ec7196f596119b2

Download Submit
C:\Users\Admin\AppData\Roaming\wuRZZuuLwNuXVPROBKQPFG.Admin\Process.txt

Filesize
1KB

MD5
025c5aa90e5e6bc021ecd332b57f5c6f

SHA1
69196261e73fa8730184c026708ad8e56d03e539

SHA256
e9c0329e1b2524be82561c706a87cab6a59f8a43d9bc54b37e6eba89c63cfef2

SHA512
edcb4843a8159bed216b7fb48324b4185b9e5bed05ab1fc63b6149042eae3c50afd05d2d23fc215287208dca96fda28c3dbb545d604fc34066adff3767d2209f

Download Submit
C:\Users\Admin\AppData\Roaming\wuRZZuuLwNuXVPROBKQPFG.Admin\Process.txt

Filesize
1KB

MD5
c487ce2b8d0a177a941f79756b5b49d5

SHA1
d874e579863abd980cad3ee8f7865411b318aa66

SHA256
1d1fcedba8dbdc6dc438f573cdfe7d29544aee8771066e9c426425027ff25d15

SHA512
075a3016af1bfa2b8570a0804cad2457dd7c7f073e402ab2d2eb3850cc05d70443157dcc45eaea59e12e33fde618d4d26d6be37e36fd7006798eb4d215a94ae8

Download Submit
memory/1736-133-0x0000000000B50000-0x0000000000B92000-memory.dmp

Filesize
264KB

Download
memory/1736-134-0x0000000005590000-0x00000000055A0000-memory.dmp

Filesize
64KB

Download
memory/1736-135-0x0000000005E00000-0x0000000005E92000-memory.dmp

Filesize
584KB

Download
memory/1736-178-0x0000000006C10000-0x00000000071B4000-memory.dmp

Filesize
5.6MB

Download
memory/1736-261-0x0000000007C70000-0x0000000007CD6000-memory.dmp

Filesize
408KB

Download

Analysis

Sharing