blackguard | 6e178c0fb8198d21b85f9179c731a2e203e2c112bc017848c4b2361ef1411619 | Triage

Analysis

max time kernel
79s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 21:42

Sharing

Report Analysis Logs

General

Target

yhjkjkgrgj.exe
Size

3.2MB
MD5

dce3c6ed046018eac08f82942401123d
SHA1

a2556fd4c7bbd8cd3b30c2eaa6aad272e52a858d
SHA256

6e178c0fb8198d21b85f9179c731a2e203e2c112bc017848c4b2361ef1411619
SHA512

ce5ca34369629fe66fafcd2b94018464ecc3bdb08c2ee83c517921997975a75ae57720824abd23bca92ad664d1bd2ea3065ae248ffe9a0f6affc77156c90d88c
SSDEEP

98304:sTdsIG91TVghsRfyX4hmE01E7oQWOq4+iPx:kWIk5RciR7cv

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

C2

https://ritmflow.online/

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	1740	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	yhjkjkgrgj.exe

C:\Users\Admin\AppData\Local\Temp\yhjkjkgrgj.exe
"C:\Users\Admin\AppData\Local\Temp\yhjkjkgrgj.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1740 -s 1980
  2⤵
  - Program crash
  PID:776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 184 -p 1740 -ip 1740
1⤵
PID:2456

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-133-0x000001D6381E0000-0x000001D638516000-memory.dmp

Filesize
3.2MB

Download
memory/1740-134-0x000001D638860000-0x000001D638870000-memory.dmp

Filesize
64KB

Download
memory/1740-135-0x000001D638860000-0x000001D638870000-memory.dmp

Filesize
64KB

Download