Analysis
-
max time kernel
118s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
11-10-2023 13:50
General
-
Target
0x00070000000120e4-3.exe
-
Size
4.6MB
-
MD5
eb7f803cbace4fbc19716180481fbbe1
-
SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd
-
SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081
-
SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886
-
SSDEEP
98304:5Ucwti78OqJ7TPBmYVrsk9N8ivyhAdsPSQxHXK7DW/yFKq:5Ucwti7TQlBVN8iNISCXK7DW8Kq
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x00070000000120e4-3.exe"C:\Users\Admin\AppData\Local\Temp\0x00070000000120e4-3.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
385B
MD5f52787cd7ed01c22bee40ac29a5f4ab5
SHA14d56bfe40dfa5a849193f010681bbdc156a8b293
SHA256ad694bdc3203d78f54dc772fde404d8221190ad6631379dd67fe06f32323ce8b
SHA512efa470febc917050b628c70d4517f543e9c2dc939dc6955ec85c75540d5e5b0498d1f3e5f6b69372282f725a92a516343f6e66e67e4e8c286c8c85d160b180b3
-
Filesize
4.6MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
712KB
-
Filesize
360KB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
3.2MB
-
Filesize
9.9MB