blackguard | c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16

General

Target

c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe
Size

6.7MB
MD5

41b8caca7e2c1ec36c2528fcd6a3f334
SHA1

45ef2451a4916cf5c88e90eb1e4360f04ba3549e
SHA256

c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16
SHA512

f160616571478eb55fb6a61c94961c7c47b0db56f03638918641fdfbc505e929921b88a9059d44554edee6e6a1c4e73127c0db0fe9df0df8d69ac73f9fa4599f
SSDEEP

196608:Rrp3ECTkyi+4l72FW1aq3BzV+gSYyPO6GEkhQAp6UFj4:VHw/lqFWYq3lV+gSYyP3GEkmJ

Score

10^/10

blackguard spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 1 IoCs

pid	Process
2180	v1.exe

Loads dropped DLL 2 IoCs

pid	Process
2472	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe
2180	v1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com
6	freegeoip.app
7	freegeoip.app

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	v1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	v1.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2180	v1.exe
2180	v1.exe
2180	v1.exe
2180	v1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	v1.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2180	2472	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28
PID 2472 wrote to memory of 2180	2472	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28
PID 2472 wrote to memory of 2180	2472	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28
PID 2472 wrote to memory of 2180	2472	c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe
"C:\Users\Admin\AppData\Local\Temp\c59fdd5b90add682937cc8dfccfb84d460ea9f14c3dc9df895a0b8596877fb16_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\v1.exe
  "C:\Users\Admin\AppData\Local\Temp\v1.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
C:\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\Process.txt

Filesize
265B

MD5
9b53b2ae3b4025bd570fab32574e8255

SHA1
d670e9db12c604354ea6acad1ba3ac9462c89ab5

SHA256
d11620a44f2f8203ffa2884519f05f5324d778031715ff112ba8f8aac58fa8eb

SHA512
8da0c8b4217b497affa85447c31b6290fd540722187be90b6421ab32312f2d778b9c08310a9a78b2518ded0cba52f75bb728b50e352cb663af612035385fb396

Download Submit
C:\Users\Admin\AppData\Roaming\SystemFiles\Process.txt

Filesize
398B

MD5
17a089fbc8a5c3bf60c82b4cc8db7ded

SHA1
4706fcd63b3b87b2d679e89b701dc21828b69379

SHA256
6989a6b8f73f383982bbbd9dc666cda670c8a004a5c17e3b9a7628de5d03410b

SHA512
4e89e9a824b2e51bcfc157d29a2220acec7782f48de265b798a7a8e23bad8fc2f88a658f33bbaf6b2c1cfcef7efa9bbce0b65312ca31d4108f62f5b34f412304

Download Submit
\Users\Admin\AppData\Local\Temp\SQLite.Interop.dll

Filesize
1.7MB

MD5
a73fdfb6815b151848257eca042a42ef

SHA1
73f18e6b4d1f638e7ce2a7ad36635018482f2c55

SHA256
10c9ccec863ed80850c7b7080e4f2e34b133ce259d1ae3ea7a305cebf6e2940d

SHA512
111f5a7bd916ab317fc127cbf49a2a81c2a614ce3a655a0446f2ebf3c2e61509db5633a391bef06c4ba0b58a71c752262ec2467a09abc56827263c647b08a09d

Download Submit
\Users\Admin\AppData\Local\Temp\v1.exe

Filesize
4.6MB

MD5
eb7f803cbace4fbc19716180481fbbe1

SHA1
9525001f6f88209d76baeba2eaf7a4d9325240dd

SHA256
bc79161f2093625fe17b17337979ccfdcedd18ff473ec008999f21f2b77bb081

SHA512
4d9cac839c2cacbfe3ff9c6a74ce22b2a68e8929dd3d89982dd6ea4640dad0e3215c6291cd0734b87c29ddf6880f8efec0bce43eb701492c6c2fe42dd0fdc886

Download Submit
memory/2180-12-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2180-16-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download
memory/2180-17-0x0000000002840000-0x000000000289A000-memory.dmp

Filesize
360KB

Download
memory/2180-18-0x0000000000940000-0x000000000095A000-memory.dmp

Filesize
104KB

Download
memory/2180-25-0x000000001B240000-0x000000001B2A6000-memory.dmp

Filesize
408KB

Download
memory/2180-15-0x0000000000570000-0x0000000000622000-memory.dmp

Filesize
712KB

Download
memory/2180-14-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2180-43-0x000000001D050000-0x000000001D37E000-memory.dmp

Filesize
3.2MB

Download
memory/2180-13-0x000000001B580000-0x000000001B600000-memory.dmp

Filesize
512KB

Download
memory/2180-73-0x0000000000A00000-0x0000000000A25000-memory.dmp

Filesize
148KB

Download
memory/2180-11-0x0000000000A30000-0x0000000000EC8000-memory.dmp

Filesize
4.6MB

Download
memory/2180-82-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing