blackguard | c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16

General

Target

c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe
Size

6.7MB
MD5

41b8caca7e2c1ec36c2528fcd6a3f334
SHA1

45ef2451a4916cf5c88e90eb1e4360f04ba3549e
SHA256

c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16
SHA512

f160616571478eb55fb6a61c94961c7c47b0db56f03638918641fdfbc505e929921b88a9059d44554edee6e6a1c4e73127c0db0fe9df0df8d69ac73f9fa4599f
SSDEEP

196608:Rrp3ECTkyi+4l72FW1aq3BzV+gSYyPO6GEkhQAp6UFj4:VHw/lqFWYq3lV+gSYyP3GEkmJ

Score

10^/10

blackguard spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 1 IoCs

pid	Process
2188	v1.exe

Loads dropped DLL 2 IoCs

pid	Process
2964	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe
2188	v1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	ip-api.com
4	freegeoip.app
5	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	v1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	v1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2188	v1.exe
2188	v1.exe
2188	v1.exe
2188	v1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2188	v1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2188	2964	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28
PID 2964 wrote to memory of 2188	2964	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28
PID 2964 wrote to memory of 2188	2964	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28
PID 2964 wrote to memory of 2188	2964	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\v1.exe
  "C:\Users\Admin\AppData\Local\Temp\v1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SystemFiles\Process.txt

Filesize
287B

MD5
c4553a780baab39e6bccf1a5546a3bf4

SHA1
3a00bd135667578c503e1092c4f93e77de3f1c33

SHA256
1ffab894ea74150871e477ee856813296ca6831afa43b28cd370541959ba3c63

SHA512
8a33063ba35dc167d7c094d13a2d51e8b2277782f464bc73283740136e159ee351241ee5ec6e8423e0485177e31ba59e3b1902fd363ea114a1e8a62edcc2c125

Download Submit
C:\Users\Admin\AppData\Local\SystemFiles\Process.txt

Filesize
367B

MD5
dd56146e432db3d5a2f3f84f20f8a983

SHA1
88ecdc466ca7cb2524800d530dc8defe61e466e0

SHA256
68ebe580a27912c8d2e88992250e9ab54d718180333e3e33896e7c28cf678d98

SHA512
263c287fb22b69dbea5bedbd1b53b3103eb2114e270fcc7cbd80713ce6ca5a526b6436ea2cf1effb0d2d8068f994b831a189a2d62313ba00bef2f1488d261f7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
memory/2188-12-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download
memory/2188-16-0x00000000004F0000-0x000000000050A000-memory.dmp

Filesize
104KB

Download
memory/2188-31-0x000000001AC40000-0x000000001ACA6000-memory.dmp

Filesize
408KB

Download
memory/2188-39-0x000000001C970000-0x000000001CC9E000-memory.dmp

Filesize
3.2MB

Download
memory/2188-15-0x0000000002710000-0x000000000276A000-memory.dmp

Filesize
360KB

Download
memory/2188-14-0x000000001AB90000-0x000000001AC42000-memory.dmp

Filesize
712KB

Download
memory/2188-43-0x0000000000330000-0x0000000000355000-memory.dmp

Filesize
148KB

Download
memory/2188-44-0x000000001ACD0000-0x000000001AD50000-memory.dmp

Filesize
512KB

Download
memory/2188-13-0x000000001ACD0000-0x000000001AD50000-memory.dmp

Filesize
512KB

Download
memory/2188-11-0x0000000000B10000-0x0000000000FA8000-memory.dmp

Filesize
4.6MB

Download
memory/2188-82-0x000007FEF5BE0000-0x000007FEF65CC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing