Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27-12-2023 05:03
General
-
Target
a4849cead4dfa68295a47c5471422ffd.exe
-
Size
1.5MB
-
MD5
a4849cead4dfa68295a47c5471422ffd
-
SHA1
c6c5e9a0a3c37c583def626f9bc227c0c294fa8a
-
SHA256
49977d7ebceb8b390b44ed50f6447ce0910c9fc73b1bfdd60eef219138d0038e
-
SHA512
df17c9ecc176bae94aeab4bf5ec6733198e6b961baca50465bce6c2d2acf6cf070ad9b3ed4e6efa64d4beec3d5de24f0cfdcd7ac0c7bd8ddabf810cae324b4a4
-
SSDEEP
24576:CGR2feTKmUp6t23c51lT9y+wvfH79MPxvvdvOyoldbUzkvdHXFcTjYu8AlmeX5J5:CGR2fnn/3cV8+wvzCxlvOyovbUkITjhV
Malware Config
Extracted
blackguard
https://api.telegram.org/bot1818730721:AAGgMZz8w6trwd7tHAnNbu0kJSmYFV_IvXk/sendMessage?chat_id=1610877447
Signatures
-
44Caliber
An open source infostealer written in C#.
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4849cead4dfa68295a47c5471422ffd.exe"C:\Users\Admin\AppData\Local\Temp\a4849cead4dfa68295a47c5471422ffd.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
276B
MD5b438234d8416d588c9321e436a80aa10
SHA1da47e186c1a583f088fb17d9c02fd2ae6a735e8b
SHA2565528501a047b4b57e84595cd1b3b523661af1b453202947b65c19ebc03bf5777
SHA512d0cd83867902baf636fc28e8529b8cbf739d7a2617b466ad81b7a71a6de78ae6806d1838c4b472143b21b9c426616587853852388259c3543f73960010d69af1
-
Filesize
736B
MD564ba1856d9e57a6a9eededc797955824
SHA1b6410045265d5d9597aaa2bd84c96eecfc42d986
SHA256182857ee84ea0adf5757e09cba8268b4574f78a5717ada9f4faf415ce75721a9
SHA512ffc7d11a98c7f9bc7697aa930597d680edee467d37a46df2fb364c1ec49ba65b3fcd892c9b0454de9e9475d8d7cf1e05f9dbaf5cbf04127f90bb9001858705ee
-
Filesize
941B
MD5c5f30aa29af53cb52d71a84f211292d1
SHA1522b79c1e9a05d7311bdb6e8dec9f35c917c337f
SHA2568ab0471cd213c41a43d6109e3ef937691e4e7608657ee99fce7b4313d611530f
SHA512cf7b697607e59d73a5eabc9fb417a8517cd2bc5a780da2bf49ba98cfdf4d72e624f697c1104912fe15c4e8eb01f8e3587ebafe2100de8703e104c0dabeac4126
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
4.6MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
4.6MB
-
Filesize
4.6MB
-
Filesize
7.7MB