blackguard | 76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341

General

Target

76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe
Size

6.7MB
MD5

0996bf4a8aebacc0a1347560fe88ef4f
SHA1

d1648477f3e92ab9c37505508edba3c545830ba1
SHA256

76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341
SHA512

dba483fafd355222734cfeeb6398e50f0e421f0818e161ff371bc2097dbec2f3ca2a39bfa0291b682585a62bec20f506d7c087b991674d376e5bffd2068c47cf
SSDEEP

196608:pjgzOD2Bc32qd+boXKgr6ONQzYe1OURJziRMh9oSC5:h6OD/32qS4T9qO6JdnRC5

Score

10^/10

blackguard persistence spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 2 IoCs

pid	Process
2548	VegaStealer_v1.exe
676	v1.exe

Loads dropped DLL 2 IoCs

pid	Process
2548	VegaStealer_v1.exe
676	v1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\VegaStealer_v1 = "C:\\Windows\\System32\\VegaStealer_v1.exe"	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
4	freegeoip.app
5	freegeoip.app

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\VegaStealer_v1.exe	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe
File opened for modification	C:\Windows\System32\VegaStealer_v1.exe	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	v1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	v1.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3004	powershell.exe
676	v1.exe
676	v1.exe
676	v1.exe
676	v1.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeDebugPrivilege	676	v1.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 3004	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	28
PID 2104 wrote to memory of 3004	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	28
PID 2104 wrote to memory of 3004	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	28
PID 2104 wrote to memory of 2696	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	30
PID 2104 wrote to memory of 2696	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	30
PID 2104 wrote to memory of 2696	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	30
PID 2104 wrote to memory of 2548	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	33
PID 2104 wrote to memory of 2548	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	33
PID 2104 wrote to memory of 2548	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	33
PID 2104 wrote to memory of 2548	2104	76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe	33
PID 2548 wrote to memory of 676	2548	VegaStealer_v1.exe	35
PID 2548 wrote to memory of 676	2548	VegaStealer_v1.exe	35
PID 2548 wrote to memory of 676	2548	VegaStealer_v1.exe	35
PID 2548 wrote to memory of 676	2548	VegaStealer_v1.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe
"C:\Users\Admin\AppData\Local\Temp\76ccfdef0238ce829c2cfcb9e3f844a905b6c5104b31cfbf01b8dffe31565341.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\VegaStealer_v1.exe'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /F /TN "VegaStealer_v1" /SC ONLOGON /TR "C:\Windows\System32\VegaStealer_v1.exe" /RL HIGHEST
  2⤵
  - Creates scheduled task(s)
  PID:2696
- C:\Windows\System32\VegaStealer_v1.exe
  "C:\Windows\System32\VegaStealer_v1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\v1.exe
    "C:\Users\Admin\AppData\Local\Temp\v1.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SystemFiles\Process.txt

Filesize
398B

MD5
691b79a247f60fa9d91bdca916eaa136

SHA1
85ad8de409eb9eb9edd3e53dfc03dfaaf97d5719

SHA256
0c70cfd37c899e90441dda7dc9226e40c98b57a0b57d2bc207e584c04efcad6e

SHA512
738f1d74efb587e6a9a6890c46b293862b624b1b5ba5672d225116eb5c454e3ebd44a0bb2fa60181cdc0775c3f16de60c1662965482c14105a448ff2e770eee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
b40ca8af659de809d815cd2906ecb67f

SHA1
ef6f378282c8e5242ba5817c2b1765e48e7fef1b

SHA256
ab51e563329b08ecfb720ef892be727923432e9b56b4923eada14b118317f8b6

SHA512
e48dab43e931129a372a7e615150555bbf0eaa1765dfb94d29e86331e0f04ae730386e9280f9df5272eee926cfa600f4c47858ec51d73d9ce2c2e47195dd1d9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
b40ca8af659de809d815cd2906ecb67f

SHA1
ef6f378282c8e5242ba5817c2b1765e48e7fef1b

SHA256
ab51e563329b08ecfb720ef892be727923432e9b56b4923eada14b118317f8b6

SHA512
e48dab43e931129a372a7e615150555bbf0eaa1765dfb94d29e86331e0f04ae730386e9280f9df5272eee926cfa600f4c47858ec51d73d9ce2c2e47195dd1d9d

Download Submit
C:\Windows\System32\VegaStealer_v1.exe

Filesize
6.7MB

MD5
c762f5d8c82d6f95f3ac2da631a3930f

SHA1
810f267836b41d46d2a23dfe32b596751c025a93

SHA256
2722e3606e78136e7b52638a59249a5c5b8397f9b5c30c0d5e28001dcc747162

SHA512
82a8bf8d918a3ba0370e7732b5fd6e3c4a460becc09ee55da065d16963a073a879da0bf7e3e716b39a1402c7a68561e3cdbc0101b05d661338d3f0624b1c472a

Download Submit
C:\Windows\System32\VegaStealer_v1.exe

Filesize
6.7MB

MD5
c762f5d8c82d6f95f3ac2da631a3930f

SHA1
810f267836b41d46d2a23dfe32b596751c025a93

SHA256
2722e3606e78136e7b52638a59249a5c5b8397f9b5c30c0d5e28001dcc747162

SHA512
82a8bf8d918a3ba0370e7732b5fd6e3c4a460becc09ee55da065d16963a073a879da0bf7e3e716b39a1402c7a68561e3cdbc0101b05d661338d3f0624b1c472a

Download Submit
\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
b40ca8af659de809d815cd2906ecb67f

SHA1
ef6f378282c8e5242ba5817c2b1765e48e7fef1b

SHA256
ab51e563329b08ecfb720ef892be727923432e9b56b4923eada14b118317f8b6

SHA512
e48dab43e931129a372a7e615150555bbf0eaa1765dfb94d29e86331e0f04ae730386e9280f9df5272eee926cfa600f4c47858ec51d73d9ce2c2e47195dd1d9d

Download Submit
memory/676-42-0x00000000026A0000-0x00000000026BA000-memory.dmp

Filesize
104KB

Download
memory/676-64-0x000000001D090000-0x000000001D3BE000-memory.dmp

Filesize
3.2MB

Download
memory/676-109-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/676-107-0x000000001B350000-0x000000001B3D0000-memory.dmp

Filesize
512KB

Download
memory/676-41-0x0000000000B00000-0x0000000000B5A000-memory.dmp

Filesize
360KB

Download
memory/676-99-0x00000000008B0000-0x00000000008D5000-memory.dmp

Filesize
148KB

Download
memory/676-39-0x00000000008F0000-0x00000000009A2000-memory.dmp

Filesize
712KB

Download
memory/676-69-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/676-38-0x000000001B350000-0x000000001B3D0000-memory.dmp

Filesize
512KB

Download
memory/676-43-0x0000000002860000-0x00000000028C6000-memory.dmp

Filesize
408KB

Download
memory/676-37-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/676-34-0x0000000000310000-0x00000000007A8000-memory.dmp

Filesize
4.6MB

Download
memory/2104-2-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/2104-1-0x0000000000980000-0x0000000001040000-memory.dmp

Filesize
6.8MB

Download
memory/2104-40-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/2104-16-0x000000001C090000-0x000000001C110000-memory.dmp

Filesize
512KB

Download
memory/2104-0-0x000007FEF56C0000-0x000007FEF60AC000-memory.dmp

Filesize
9.9MB

Download
memory/3004-10-0x000007FEF1BC0000-0x000007FEF255D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-8-0x0000000002090000-0x0000000002098000-memory.dmp

Filesize
32KB

Download
memory/3004-7-0x000000001B3D0000-0x000000001B6B2000-memory.dmp

Filesize
2.9MB

Download
memory/3004-9-0x000007FEF1BC0000-0x000007FEF255D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-14-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/3004-11-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/3004-12-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/3004-15-0x000007FEF1BC0000-0x000007FEF255D000-memory.dmp

Filesize
9.6MB

Download
memory/3004-13-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads