blackguard | c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16

General

Target

VegaStealer_v1.bin.exe
Size

6.7MB
MD5

41b8caca7e2c1ec36c2528fcd6a3f334
SHA1

45ef2451a4916cf5c88e90eb1e4360f04ba3549e
SHA256

c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16
SHA512

f160616571478eb55fb6a61c94961c7c47b0db56f03638918641fdfbc505e929921b88a9059d44554edee6e6a1c4e73127c0db0fe9df0df8d69ac73f9fa4599f
SSDEEP

196608:Rrp3ECTkyi+4l72FW1aq3BzV+gSYyPO6GEkhQAp6UFj4:VHw/lqFWYq3lV+gSYyP3GEkmJ

Score

10^/10

blackguard spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 1 IoCs

pid	Process
2308	v1.exe

Loads dropped DLL 2 IoCs

pid	Process
2976	VegaStealer_v1.bin.exe
2308	v1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com
6	freegeoip.app
7	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	v1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	v1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2308	v1.exe
2308	v1.exe
2308	v1.exe
2308	v1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2308	v1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2308	2976	VegaStealer_v1.bin.exe	28
PID 2976 wrote to memory of 2308	2976	VegaStealer_v1.bin.exe	28
PID 2976 wrote to memory of 2308	2976	VegaStealer_v1.bin.exe	28
PID 2976 wrote to memory of 2308	2976	VegaStealer_v1.bin.exe	28

C:\Users\Admin\AppData\Local\Temp\VegaStealer_v1.bin.exe
"C:\Users\Admin\AppData\Local\Temp\VegaStealer_v1.bin.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\v1.exe
  "C:\Users\Admin\AppData\Local\Temp\v1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\Process.txt

Filesize
141B

MD5
3b6f39dc5393661da9710c329d0d2bd4

SHA1
80d98b9f524ab747f4b4a3df023662be1bafabda

SHA256
fac8165db62b1e4a6816a9ee2d16b344288d63373a575ce681f99b3221201fc9

SHA512
fd4489a76c45d97789423bc7ebad6b8073ea675bd7f4d1ad6d4f241ee4157f02405ca54f80034f30647cc28ba32858df8dcea510d746a1a8f80d6f8e0d63c872

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\Process.txt

Filesize
367B

MD5
858dc12dbdd811b43fc1c4e99d401efa

SHA1
e5bd4323add2cdf09ef61a4213fe5bb4771d038a

SHA256
3193812bbd30988f0caec7eb9cd0e391af2c31833cad2d672bbb18359c95c605

SHA512
b2f8b223576c6e64dc4944a5767818e58b7d7510c16b4edb09ad5b7b470f7d68f349cc23e27eaca47bb66301fc9af321406d887762310197dbebdbbb5f30789d

Download Submit
\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
memory/2308-12-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2308-16-0x0000000002410000-0x000000000242A000-memory.dmp

Filesize
104KB

Download
memory/2308-34-0x000000001AC00000-0x000000001AC66000-memory.dmp

Filesize
408KB

Download
memory/2308-40-0x000000001C970000-0x000000001CC9E000-memory.dmp

Filesize
3.2MB

Download
memory/2308-15-0x0000000002330000-0x000000000238A000-memory.dmp

Filesize
360KB

Download
memory/2308-14-0x000000001AAD0000-0x000000001AB82000-memory.dmp

Filesize
712KB

Download
memory/2308-42-0x00000000008B0000-0x00000000008D5000-memory.dmp

Filesize
148KB

Download
memory/2308-43-0x000000001B350000-0x000000001B3D0000-memory.dmp

Filesize
512KB

Download
memory/2308-13-0x000000001B350000-0x000000001B3D0000-memory.dmp

Filesize
512KB

Download
memory/2308-11-0x0000000000900000-0x0000000000D98000-memory.dmp

Filesize
4.6MB

Download
memory/2308-79-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing