Analysis
- max time kernel
82s - max time network
103s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
02/04/2023, 02:09
General
- Target dce3c6ed046018eac08f82942401123d.exe
- Size 3.2MB
- Sample230402-ck7dwafd81
- SHA256 6e178c0fb8198d21b85f9179c731a2e203e2c112bc017848c4b2361ef1411619
Score
10/10
Malware Config
Extracted
Family
-
blackguard
C2
-
https://ritmflow.online/
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Program crash 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dce3c6ed046018eac08f82942401123d.exe"C:\Users\Admin\AppData\Local\Temp\dce3c6ed046018eac08f82942401123d.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2432 -s 19922⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 456 -p 2432 -ip 24321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2432-133-0x0000023FE6880000-0x0000023FE6BB6000-memory.dmp
memory/2432-134-0x0000023FE86C0000-0x0000023FE86D0000-memory.dmp
memory/2432-135-0x0000023FE86C0000-0x0000023FE86D0000-memory.dmp