Analysis
-
max time kernel
1705s -
max time network
1160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
-
submitted
13-12-2023 18:16
General
-
Target
expensive 3.0.exe
-
Size
7.7MB
-
MD5
5de68ee2fd224e921d0579eeb6b34ba1
-
SHA1
e8d72b224941659b615f1d9c4641a91d3c1feccc
-
SHA256
dd948a89e3fd50fe35c481187ac77683ebab5661985d743a6c77681239a96a9d
-
SHA512
eed070c640508d740ef927ad50b7daac7a435ff0b6c734136021c9f0972b330d6d456288bd7419ac9beced203e39d0dea3bd0c10002856a268e7bc68919b61c2
-
SSDEEP
98304:fCru1T5fc7Ec0Nlb184vvhXd/GyR2tpw7aTIIXAKPq5XtR1kT3oh2YlybGZenLT:fCrkN2V0Nj8EXIT+7LIX5qJh2Ylysi3
Malware Config
Extracted
blackguard
https://api.telegram.org/bot5808551742:AAEg1HZDZFvbSau_b6rSW4mu5bhz5EJUj0Q/sendMessage?chat_id=5035053251
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\expensive 3.0.exe"C:\Users\Admin\AppData\Local\Temp\expensive 3.0.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
571KB
MD5169b6d383b7c650ab3ae2129397a6cf3
SHA1fcaef7defb04301fd55fb1421bb15ef96d7040d6
SHA256b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf
SHA5127a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87
-
Filesize
490KB
MD5d75594b340a0e57c8ba70d6eb94174fc
SHA13f79e7baf0f9fcb2781cd4febb56268e47c9599f
SHA256ee651f053c1810a6aa3f8cb880f3769531b379df74c94cb3c92724581c17e5dc
SHA512df42d060221713bfcad59c2a34c1cf2ca72aacd51064fc897f913e217373a4c1dec75c30c53d1ed9bec134d411bea668f955a7dbbd27151cffebcbfa029dd728
-
Filesize
378KB
MD551a62039b4810e75c0b9f8bba5cada0b
SHA14391db71c561871ceb06e6894440dc638625c7af
SHA2565a5d7ee85b7016673e634eb9036a13f2b7353fadfb863bc8e647f66723c19267
SHA512ff94a2e4539fdc072671975b4c07f6846b4acab397945fadeef39902bdcca5cf7e7e938365341dce8e1e6b28a57e6d427ec9b6021d1bce5d040bd5a6a1bda271
-
Filesize
1.3MB
MD50a1e95b0b1535203a1b8479dff2c03ff
SHA120c4b4406e8a3b1b35ca739ed59aa07ba867043d
SHA256788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e
SHA512854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e
-
Filesize
410KB
MD5056d3fcaf3b1d32ff25f513621e2a372
SHA1851740bca46bab71d0b1d47e47f3eb8358cbee03
SHA25666b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9
SHA512ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180
-
Filesize
49KB
MD5166bf7288ff70a58f53584b697997eb3
SHA18494da67c749d75990a168cc70f555a27c8f5e8d
SHA2564f6edb783fedd7ded8b7bee4fc41618e69bf091c555116c65aaf8a93ac1de6a3
SHA5120a05c16b4b9d39c247fd87d3582de7dc888036f36caed4974fbfcc3b23822c057e6f0497973603c69a0cecca9c7f351507bf61224fa216f44ad0c19c4f6d6d8f
-
Filesize
271KB
MD537a4d684c102f1d383e1aad3900db414
SHA18f6b414a183cb702fb03ac5269ace9f38e2ecd5f
SHA256dde6c36477dc733bd67850ebc75d6437e6ada5b8b9b239b930bad338e9f3e363
SHA512a5e8d799d9b726cd03f5d7ac77d8727f4fb753a070f3799c8a9570edd3d8a01074f115fac5e9cd1ea412d3d9e9b7c240bfdddda2595cb1ec5f943d97f1562641
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
319B
MD53c9029676ea3c6f7c2d9908b8dbb2b1a
SHA1b34cc3fbc96cd82a0d4df3919c960d0c4e6e33c8
SHA2565cccbc18a15df60f3b5278d6595d9fdea5b4504781c73ed72c1413c57b0815db
SHA512e5bedb348ed7fe12905561e71d2ee3992c9b1748b6e7e9d9f2baf6e6d310c5d2e2efce8d26f7d25222f52805fea21d833944f0f57484baa697ed737a0cb815ae
-
Filesize
1KB
MD597efa8645b474e4f1da40405659b54ba
SHA1984f9ee5fd25e534a0dcaa2cda9773cc79f9efa5
SHA25621b7d22ee030d3d7c74fbc99e3b11f6fbd86208f226d2b9f01fd05918beec057
SHA51223f0192b4ddfe7aca9c7a0bfca806d44b0c07b78464cc716739bf189283df03285e4743e0ee2c34ec668636696397825cf05162e6feb25ec51c7a06abac547c0
-
Filesize
3.3MB
-
Filesize
132KB
-
Filesize
320KB
-
Filesize
416KB
-
Filesize
296KB
-
Filesize
584KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
136KB
-
Filesize
1.8MB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
7.7MB