blackguard | 6e178c0fb8198d21b85f9179c731a2e203e2c112bc017848c4b2361ef1411619 | Triage

Analysis

max time kernel
82s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02-04-2023 02:09

Sharing

Report Analysis Logs

General

Target

dce3c6ed046018eac08f82942401123d.exe
Size

3.2MB
MD5

dce3c6ed046018eac08f82942401123d
SHA1

a2556fd4c7bbd8cd3b30c2eaa6aad272e52a858d
SHA256

6e178c0fb8198d21b85f9179c731a2e203e2c112bc017848c4b2361ef1411619
SHA512

ce5ca34369629fe66fafcd2b94018464ecc3bdb08c2ee83c517921997975a75ae57720824abd23bca92ad664d1bd2ea3065ae248ffe9a0f6affc77156c90d88c
SSDEEP

98304:sTdsIG91TVghsRfyX4hmE01E7oQWOq4+iPx:kWIk5RciR7cv

Score

10^/10

blackguard stealer

Malware Config

Extracted

Family

blackguard

C2

https://ritmflow.online/

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4716	2432	WerFault.exe	85

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	dce3c6ed046018eac08f82942401123d.exe

C:\Users\Admin\AppData\Local\Temp\dce3c6ed046018eac08f82942401123d.exe
"C:\Users\Admin\AppData\Local\Temp\dce3c6ed046018eac08f82942401123d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2432 -s 1992
  2⤵
  - Program crash
  PID:4716

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 2432 -ip 2432
1⤵
PID:3440

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-133-0x0000023FE6880000-0x0000023FE6BB6000-memory.dmp

Filesize
3.2MB

Download
memory/2432-134-0x0000023FE86C0000-0x0000023FE86D0000-memory.dmp

Filesize
64KB

Download
memory/2432-135-0x0000023FE86C0000-0x0000023FE86D0000-memory.dmp

Filesize
64KB

Download