Analysis
-
max time kernel
1516s -
max time network
1507s -
platform
windows11-21h2_x64 -
resource
win11-20231128-en -
resource tags
-
submitted
13-12-2023 18:16
General
-
Target
expensive 3.0.exe
-
Size
7.7MB
-
MD5
5de68ee2fd224e921d0579eeb6b34ba1
-
SHA1
e8d72b224941659b615f1d9c4641a91d3c1feccc
-
SHA256
dd948a89e3fd50fe35c481187ac77683ebab5661985d743a6c77681239a96a9d
-
SHA512
eed070c640508d740ef927ad50b7daac7a435ff0b6c734136021c9f0972b330d6d456288bd7419ac9beced203e39d0dea3bd0c10002856a268e7bc68919b61c2
-
SSDEEP
98304:fCru1T5fc7Ec0Nlb184vvhXd/GyR2tpw7aTIIXAKPq5XtR1kT3oh2YlybGZenLT:fCrkN2V0Nj8EXIT+7LIX5qJh2Ylysi3
Malware Config
Extracted
blackguard
https://api.telegram.org/bot5808551742:AAEg1HZDZFvbSau_b6rSW4mu5bhz5EJUj0Q/sendMessage?chat_id=5035053251
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\expensive 3.0.exe"C:\Users\Admin\AppData\Local\Temp\expensive 3.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
571KB
MD5169b6d383b7c650ab3ae2129397a6cf3
SHA1fcaef7defb04301fd55fb1421bb15ef96d7040d6
SHA256b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf
SHA5127a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87
-
Filesize
192KB
MD563d5d797573dc5e4b4490ee1e98f3c29
SHA1803245a86b956b597a2ad88f5c3160dfab026c50
SHA256a80394850b0e73398d2bc281da27b16b30058ffcc0c0ce074df7096a401bfa4c
SHA512ca9b3539b5153aa9810b129b7a6d05389cd1cd09e9912573552e81057877380a34f79c255c3801c483132c2fba4cfc959c1af3ce9db09c955a99d1b50c565808
-
Filesize
64KB
MD58f9a318cdf28667e709cd593e5ed65e9
SHA1844f7c5e3ebce373eee0bdc201b340ceb12d2eba
SHA256425bfda755adaf38c0e6980e65158fbe2ff775de6e63e72b6af5178d64beb3a0
SHA512cfe970e45815d4236152f256565f07ae09e830ac68fe2894a64eac59937c1327593246df1308bc9f7d4e588a2e1309745384de620a962378f4965ce3cf653a0f
-
Filesize
1.3MB
MD50a1e95b0b1535203a1b8479dff2c03ff
SHA120c4b4406e8a3b1b35ca739ed59aa07ba867043d
SHA256788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e
SHA512854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e
-
Filesize
410KB
MD5056d3fcaf3b1d32ff25f513621e2a372
SHA1851740bca46bab71d0b1d47e47f3eb8358cbee03
SHA25666b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9
SHA512ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180
-
Filesize
271KB
MD537a4d684c102f1d383e1aad3900db414
SHA18f6b414a183cb702fb03ac5269ace9f38e2ecd5f
SHA256dde6c36477dc733bd67850ebc75d6437e6ada5b8b9b239b930bad338e9f3e363
SHA512a5e8d799d9b726cd03f5d7ac77d8727f4fb753a070f3799c8a9570edd3d8a01074f115fac5e9cd1ea412d3d9e9b7c240bfdddda2595cb1ec5f943d97f1562641
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
605B
MD58316965ee5103b2575a75af221234121
SHA1761656ad6618ad02924111d03fcb78953ecee439
SHA256e3f7fbd249f636762965092dd6709a511e613e08b9ec9c00e4d42b8dfd69c49a
SHA512dd35ecbc11a5d0c0c3d058ad1ea9e096d432d8baa692f59852351d16d9fb53c161b9baf2b2e677eba03386411e2243a35e7556784e369485f55b4465ca71af38
-
Filesize
859B
MD5aa45a1df811b03b6c290aa991e397282
SHA16db0127804fccbc4e6dab80dc1209e3b124894b2
SHA2561a9498f9389f4d9cc72fb9eb39d7514d69709b642fcbf8f4379cd294e01c0023
SHA5125ede9a2b7128ee1fa6da9ea1b6f4afe66c79203d57252a88e1616711eba30c17cfd81869ef00637e663df5e795766f74ed004bcbca335e74bdd78982e0c3de87
-
Filesize
1KB
MD5375d330558ad0387ae28610487b340f1
SHA166e431ed73867bc676dd3395ccfb148b1237023e
SHA25636089f752aaea4ca5ace3b8ee4b528c6925b85b58824b9df4eb05937cd725927
SHA512386ecd1b08345f55451ce72ded4c04df9fd59f4958ee0c1cf495c70d3271257d9f21f501a40d13477e145b3a4cf3f1bd1bdec4eaee47aaacef0547570411cf08
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
416KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
584KB
-
Filesize
240KB
-
Filesize
132KB
-
Filesize
136KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
296KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
7.7MB