Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
26-09-2023 17:20
General
-
Target
0x00070000000120e4-3.exe
-
Size
4.6MB
-
MD5
eb7f803cbace4fbc19716180481fbbe1
-
SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd
-
SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081
-
SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886
-
SSDEEP
98304:5Ucwti78OqJ7TPBmYVrsk9N8ivyhAdsPSQxHXK7DW/yFKq:5Ucwti7TQlBVN8iNISCXK7DW8Kq
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x00070000000120e4-3.exe"C:\Users\Admin\AppData\Local\Temp\0x00070000000120e4-3.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385B
MD509db02cd71a067cc0fb37cfb68d307c8
SHA1ef4982a4de42e6083ce6311b146a2cf2a3497aea
SHA256fd1a52025fe78802279345aea101508bcf0347c857098602929080b027c6017e
SHA512e692123050d9926d7d2bf15d4cfb948846a8ed0c47c1a5356fcd4557848dd49c3407b8baad8e220ed83e32a65469c13c6c7668090b886622ff37aa6bcdbadf5f
-
Filesize
4.6MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
712KB
-
Filesize
360KB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
3.2MB
-
Filesize
9.9MB