blackguard | bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74

Resubmissions

20/10/2023, 03:43

231020-eabkkafc2610

13/10/2023, 23:22

231013-3ckg9agf2310

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
20/10/2023, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AYReport_EN.exe
Size 9.6MB
Sample231020-eabkkafc26
SHA256 bde2b977cdd7c086a35825a9ba7f2307341a3917f40cc193ed316dde106a6c74
MD5 ec333982af0977d8af5a4984792a4385
SHA1 d5b7e49c6476766d45a18cdd150d0679a9529a5a
SHA512 1446ecc9ca6f193796cdbaf1b9f291b85a36279659254e6cbf286dba8a0e5f233c889b459b799a0d18462f1210841a61a207f76bc90db4365a43e7d967761cfc
SSDEEP 49152:LLLjKXCrX+hMesdq40bf95X9K5NRcSJDg/u/fiGhG6E7/6bp1pBt0zKkevwN/+j:
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blackguard stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 2 IoCs

pid	Process
2364	KO30GCUU.exe
736	XG9UKCOY.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	736	XG9UKCOY.exe
Token: SeTakeOwnershipPrivilege	736	XG9UKCOY.exe
Token: SeRestorePrivilege	736	XG9UKCOY.exe
Token: SeTcbPrivilege	736	XG9UKCOY.exe
Token: SeBackupPrivilege	736	XG9UKCOY.exe
Token: SeDebugPrivilege	2364	KO30GCUU.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
736	XG9UKCOY.exe
736	XG9UKCOY.exe
736	XG9UKCOY.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2364	2336	AYReport_EN.exe	29
PID 2336 wrote to memory of 2364	2336	AYReport_EN.exe	29
PID 2336 wrote to memory of 2364	2336	AYReport_EN.exe	29
PID 2336 wrote to memory of 736	2336	AYReport_EN.exe	30
PID 2336 wrote to memory of 736	2336	AYReport_EN.exe	30
PID 2336 wrote to memory of 736	2336	AYReport_EN.exe	30
PID 2336 wrote to memory of 736	2336	AYReport_EN.exe	30
PID 2364 wrote to memory of 2704	2364	KO30GCUU.exe	34
PID 2364 wrote to memory of 2704	2364	KO30GCUU.exe	34
PID 2364 wrote to memory of 2704	2364	KO30GCUU.exe	34

C:\Users\Admin\AppData\Local\Temp\AYReport_EN.exe
"C:\Users\Admin\AppData\Local\Temp\AYReport_EN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\ProgramData\Start Menu\KO30GCUU.exe
  "C:\ProgramData\Start Menu\KO30GCUU.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2364 -s 1276
    3⤵
    PID:2704
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\XG9UKCOY.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\XG9UKCOY.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KO30GCUU.exe

Path C:\ProgramData\Microsoft\Windows\Start Menu\KO30GCUU.exe
Size 1.8MB
SHA256 c50a943a78dc0049438b810fae2973ade0350c6ad76f924348fd56daff9fdf3a
MD5 8bbaf95337912b8a1d36594e5bb2f5e6
SHA1 5db26a00543868b7f7bc88ec6597a17cf0dc71ae
SHA512 3665bbbfced55b369c0a3926fbe1682c3dc80e669d33fc523b4e23c2bbbb38f34b50d04bf369d0104d71ff99c73e9cb3d525408f0f137d7e870d7dded4196620
SSDEEP 49152:RC6pCkV5+fDepJvZA0xY1aBJ4/xRmWr55h:RC6P70MJvZecQ/xEWrR
MD5 SHA1 SHA512 SSDEEP

Submit Download

KO30GCUU.exe

Path C:\ProgramData\Start Menu\KO30GCUU.exe
Size 1.8MB
SHA256 c50a943a78dc0049438b810fae2973ade0350c6ad76f924348fd56daff9fdf3a
MD5 8bbaf95337912b8a1d36594e5bb2f5e6
SHA1 5db26a00543868b7f7bc88ec6597a17cf0dc71ae
SHA512 3665bbbfced55b369c0a3926fbe1682c3dc80e669d33fc523b4e23c2bbbb38f34b50d04bf369d0104d71ff99c73e9cb3d525408f0f137d7e870d7dded4196620
SSDEEP 49152:RC6pCkV5+fDepJvZA0xY1aBJ4/xRmWr55h:RC6P70MJvZecQ/xEWrR
MD5 SHA1 SHA512 SSDEEP

Submit Download

XG9UKCOY.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\XG9UKCOY.exe
Size 1.8MB
SHA256 0d9e31079d1626252be3d0241e9559e975a0ccf94648d4f41219119136f361f1
MD5 cdb983e76d6fc15c5eaef54a063f0091
SHA1 ff22a165f86cf929727fa12d8e787e69d24bb19c
SHA512 a665a3c222a4fb218dca8af4e10582e493e4aec146e6e5bbf1091d482ea3081528e77fc9b176f892d5ba04fe442991947acc20242b3e4885fd37a614a963f3c6
SSDEEP 49152:dVA/JKt3we3e/iRyHKixZ0DRafnoQ7FT/Yb8b:dVs83w/iyHKc0DRafo6db
MD5 SHA1 SHA512 SSDEEP

Submit Download

XG9UKCOY.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\XG9UKCOY.exe
Size 1.8MB
SHA256 0d9e31079d1626252be3d0241e9559e975a0ccf94648d4f41219119136f361f1
MD5 cdb983e76d6fc15c5eaef54a063f0091
SHA1 ff22a165f86cf929727fa12d8e787e69d24bb19c
SHA512 a665a3c222a4fb218dca8af4e10582e493e4aec146e6e5bbf1091d482ea3081528e77fc9b176f892d5ba04fe442991947acc20242b3e4885fd37a614a963f3c6
SSDEEP 49152:dVA/JKt3we3e/iRyHKixZ0DRafnoQ7FT/Yb8b:dVs83w/iyHKc0DRafo6db
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2336-0-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Download

memory/2336-1-0x0000000000B60000-0x00000000014FA000-memory.dmp

Download

memory/2336-14-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Download

memory/2364-13-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Download

memory/2364-11-0x0000000000F70000-0x000000000114C000-memory.dmp

Download

memory/2364-16-0x0000000000270000-0x00000000002F0000-memory.dmp

Download

memory/2364-17-0x000007FEF5AB0000-0x000007FEF649C000-memory.dmp

Download

memory/2364-18-0x0000000000270000-0x00000000002F0000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads