Analysis
-
max time kernel
119s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 21:31
Static task
static1
Behavioral task
behavioral1
Sample
bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe
-
Size
9.6MB
-
MD5
ec333982af0977d8af5a4984792a4385
-
SHA1
d5b7e49c6476766d45a18cdd150d0679a9529a5a
-
SHA256
bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74
-
SHA512
1446ecc9ca6f193796cdbaf1b9f291b85a36279659254e6cbf286dba8a0e5f233c889b459b799a0d18462f1210841a61a207f76bc90db4365a43e7d967761cfc
-
SSDEEP
49152:LLLjKXCrX+hMesdq40bf95X9K5NRcSJDg/u/fiGhG6E7/6bp1pBt0zKkevwN/+j:
Malware Config
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Executes dropped EXE 2 IoCs
pid Process 2160 USS8KE9R.exe 2768 X1Y0O09A.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2768 X1Y0O09A.exe Token: SeTakeOwnershipPrivilege 2768 X1Y0O09A.exe Token: SeRestorePrivilege 2768 X1Y0O09A.exe Token: SeTcbPrivilege 2768 X1Y0O09A.exe Token: SeBackupPrivilege 2768 X1Y0O09A.exe Token: SeDebugPrivilege 2160 USS8KE9R.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2768 X1Y0O09A.exe 2768 X1Y0O09A.exe 2768 X1Y0O09A.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2160 2212 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe 29 PID 2212 wrote to memory of 2160 2212 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe 29 PID 2212 wrote to memory of 2160 2212 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe 29 PID 2212 wrote to memory of 2768 2212 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe 30 PID 2212 wrote to memory of 2768 2212 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe 30 PID 2212 wrote to memory of 2768 2212 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe 30 PID 2212 wrote to memory of 2768 2212 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe 30 PID 2160 wrote to memory of 764 2160 USS8KE9R.exe 32 PID 2160 wrote to memory of 764 2160 USS8KE9R.exe 32 PID 2160 wrote to memory of 764 2160 USS8KE9R.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe"C:\Users\Admin\AppData\Local\Temp\bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Roaming\Macromedia\USS8KE9R.exe"C:\Users\Admin\AppData\Roaming\Macromedia\USS8KE9R.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2160 -s 12603⤵PID:764
-
-
-
C:\ProgramData\Templates\X1Y0O09A.exe"C:\ProgramData\Templates\X1Y0O09A.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5cdb983e76d6fc15c5eaef54a063f0091
SHA1ff22a165f86cf929727fa12d8e787e69d24bb19c
SHA2560d9e31079d1626252be3d0241e9559e975a0ccf94648d4f41219119136f361f1
SHA512a665a3c222a4fb218dca8af4e10582e493e4aec146e6e5bbf1091d482ea3081528e77fc9b176f892d5ba04fe442991947acc20242b3e4885fd37a614a963f3c6
-
Filesize
1.8MB
MD5cdb983e76d6fc15c5eaef54a063f0091
SHA1ff22a165f86cf929727fa12d8e787e69d24bb19c
SHA2560d9e31079d1626252be3d0241e9559e975a0ccf94648d4f41219119136f361f1
SHA512a665a3c222a4fb218dca8af4e10582e493e4aec146e6e5bbf1091d482ea3081528e77fc9b176f892d5ba04fe442991947acc20242b3e4885fd37a614a963f3c6
-
Filesize
1.8MB
MD58bbaf95337912b8a1d36594e5bb2f5e6
SHA15db26a00543868b7f7bc88ec6597a17cf0dc71ae
SHA256c50a943a78dc0049438b810fae2973ade0350c6ad76f924348fd56daff9fdf3a
SHA5123665bbbfced55b369c0a3926fbe1682c3dc80e669d33fc523b4e23c2bbbb38f34b50d04bf369d0104d71ff99c73e9cb3d525408f0f137d7e870d7dded4196620
-
Filesize
1.8MB
MD58bbaf95337912b8a1d36594e5bb2f5e6
SHA15db26a00543868b7f7bc88ec6597a17cf0dc71ae
SHA256c50a943a78dc0049438b810fae2973ade0350c6ad76f924348fd56daff9fdf3a
SHA5123665bbbfced55b369c0a3926fbe1682c3dc80e669d33fc523b4e23c2bbbb38f34b50d04bf369d0104d71ff99c73e9cb3d525408f0f137d7e870d7dded4196620