blackguard | c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16

General

Target

VegaStealer_v1.bin.exe
Size

6.7MB
MD5

41b8caca7e2c1ec36c2528fcd6a3f334
SHA1

45ef2451a4916cf5c88e90eb1e4360f04ba3549e
SHA256

c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16
SHA512

f160616571478eb55fb6a61c94961c7c47b0db56f03638918641fdfbc505e929921b88a9059d44554edee6e6a1c4e73127c0db0fe9df0df8d69ac73f9fa4599f
SSDEEP

196608:Rrp3ECTkyi+4l72FW1aq3BzV+gSYyPO6GEkhQAp6UFj4:VHw/lqFWYq3lV+gSYyP3GEkmJ

Score

10^/10

blackguard spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 1 IoCs

pid	Process
2708	v1.exe

Loads dropped DLL 2 IoCs

pid	Process
2572	VegaStealer_v1.bin.exe
2708	v1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
4	freegeoip.app
5	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	v1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	v1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2708	v1.exe
2708	v1.exe
2708	v1.exe
2708	v1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2708	v1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2708	2572	VegaStealer_v1.bin.exe	28
PID 2572 wrote to memory of 2708	2572	VegaStealer_v1.bin.exe	28
PID 2572 wrote to memory of 2708	2572	VegaStealer_v1.bin.exe	28
PID 2572 wrote to memory of 2708	2572	VegaStealer_v1.bin.exe	28

C:\Users\Admin\AppData\Local\Temp\VegaStealer_v1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\VegaStealer_v1.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\v1.exe
  "C:\Users\Admin\AppData\Local\Temp\v1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\Process.txt

Filesize
265B

MD5
85ef4025167f3f75f9cf6849108d405f

SHA1
edb68cfb22bb87135c528f9b7487633e746ed095

SHA256
f9cbca43b01153681c4017d7cfae8a27e473391bef81df9f06b414c607122012

SHA512
f9ad1d4695c5883e9d55985beea29464d3ecc5797ff5e04524e1ddbe0df536e89ca8f16010c32adc394f69ce70423f5f22efad4f3516ec54ec23853e13d79a3a

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\Process.txt

Filesize
367B

MD5
5f43a41bbe1c6d2341da16131535a312

SHA1
7e8c661dd42c46440f9016d9c8db86498314e887

SHA256
68aa3d50a64c10df2279c4530f50ecf60b902406ceb1ba6d7acd7fbe9014ef4b

SHA512
0b0829951442691f53776424711d7ac850b7abdb9ba1888c9eb1076d0892702130047a6828121969002e6b70ec7cd4e25542419b2f9e7cd701de94e404dc95fe

Download Submit
\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
memory/2708-12-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download
memory/2708-16-0x0000000000C20000-0x0000000000C3A000-memory.dmp

Filesize
104KB

Download
memory/2708-20-0x000000001AE50000-0x000000001AEB6000-memory.dmp

Filesize
408KB

Download
memory/2708-40-0x000000001D2E0000-0x000000001D60E000-memory.dmp

Filesize
3.2MB

Download
memory/2708-15-0x0000000000D80000-0x0000000000DDA000-memory.dmp

Filesize
360KB

Download
memory/2708-14-0x0000000000CD0000-0x0000000000D82000-memory.dmp

Filesize
712KB

Download
memory/2708-42-0x0000000000BF0000-0x0000000000C15000-memory.dmp

Filesize
148KB

Download
memory/2708-43-0x0000000000BF0000-0x0000000000C15000-memory.dmp

Filesize
148KB

Download
memory/2708-44-0x000000001B4E0000-0x000000001B560000-memory.dmp

Filesize
512KB

Download
memory/2708-13-0x000000001B4E0000-0x000000001B560000-memory.dmp

Filesize
512KB

Download
memory/2708-11-0x0000000000E20000-0x00000000012B8000-memory.dmp

Filesize
4.6MB

Download
memory/2708-80-0x000007FEF5740000-0x000007FEF612C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing