Analysis
-
max time kernel
39s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
26-09-2023 17:20
General
-
Target
0x00070000000120e4-3.exe
-
Size
4.6MB
-
MD5
eb7f803cbace4fbc19716180481fbbe1
-
SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd
-
SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081
-
SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886
-
SSDEEP
98304:5Ucwti78OqJ7TPBmYVrsk9N8ivyhAdsPSQxHXK7DW/yFKq:5Ucwti7TQlBVN8iNISCXK7DW8Kq
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x00070000000120e4-3.exe"C:\Users\Admin\AppData\Local\Temp\0x00070000000120e4-3.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a670661e1dfc2068122e625caf9ea38c
SHA1d881041463fa99a80859ea8507eb441ccf2a51bc
SHA256cd51347a31d3d757d67a77a4d399622f43e0f18b3c310a750ec8136da0f6bd42
SHA5129d40704919d9d7a7767a6a06d5e109562e6021bda50a9ff5bfd1f6ae085acb153b34528d58dc2dd0fee46a745bf592bda4fd28ad7601ddbe9c1cf4d87e4b346e
-
Filesize
1KB
MD5a670661e1dfc2068122e625caf9ea38c
SHA1d881041463fa99a80859ea8507eb441ccf2a51bc
SHA256cd51347a31d3d757d67a77a4d399622f43e0f18b3c310a750ec8136da0f6bd42
SHA5129d40704919d9d7a7767a6a06d5e109562e6021bda50a9ff5bfd1f6ae085acb153b34528d58dc2dd0fee46a745bf592bda4fd28ad7601ddbe9c1cf4d87e4b346e
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
136KB
-
Filesize
120KB
-
Filesize
360KB
-
Filesize
4.6MB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
3.2MB
-
Filesize
712KB
-
Filesize
10.8MB
-
Filesize
10.8MB