blackguard | 2a6063c7a32ca6b06174935c64894c825b29eafbea54700c0bc0a6b64be186f4

General

Target

1dc5cd47accaaebf5be57878d43a2dc0.exe
Size

1.7MB
MD5

1dc5cd47accaaebf5be57878d43a2dc0
SHA1

908e07ba8c3e9760aa42746e67e5c66b3110bb11
SHA256

2a6063c7a32ca6b06174935c64894c825b29eafbea54700c0bc0a6b64be186f4
SHA512

f3b6d684da544da1cd0a8dea28dd5abd3a4ced524492ca03278e669daa21d1a52d36f967da4fb2a04c79068b04bd1ba03fa746282bf763156637f4eb5953b6a3
SSDEEP

49152:cZ6rR44Nu+OkppJ+yoeTp3flodyZmFSykdoj9zgi4:cuR44NPpiuTp3floqmAx4q

Score

10^/10

blackguard spyware stealer

Malware Config

Extracted

Family

blackguard

C2

https://api.telegram.org/bot1910729667:AAHOpTkbYDLI9EqfJlZpo0NtC5va-gyAKbo/sendMessage?chat_id=1008805926

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 freegeoip.app
22 freegeoip.app
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

1dc5cd47accaaebf5be57878d43a2dc0.exe

pid process

2496 1dc5cd47accaaebf5be57878d43a2dc0.exe
2496 1dc5cd47accaaebf5be57878d43a2dc0.exe

flow	ioc
7	freegeoip.app
22	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1dc5cd47accaaebf5be57878d43a2dc0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	1dc5cd47accaaebf5be57878d43a2dc0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	1dc5cd47accaaebf5be57878d43a2dc0.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1dc5cd47accaaebf5be57878d43a2dc0.exe

pid	process
2496	1dc5cd47accaaebf5be57878d43a2dc0.exe
2496	1dc5cd47accaaebf5be57878d43a2dc0.exe
2496	1dc5cd47accaaebf5be57878d43a2dc0.exe
2496	1dc5cd47accaaebf5be57878d43a2dc0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1dc5cd47accaaebf5be57878d43a2dc0.exe

description pid process

Token: SeDebugPrivilege 2496 1dc5cd47accaaebf5be57878d43a2dc0.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1dc5cd47accaaebf5be57878d43a2dc0.exe

pid process

2496 1dc5cd47accaaebf5be57878d43a2dc0.exe

description	pid	process
Token: SeDebugPrivilege	2496	1dc5cd47accaaebf5be57878d43a2dc0.exe

C:\Users\Admin\AppData\Local\Temp\1dc5cd47accaaebf5be57878d43a2dc0.exe
"C:\Users\Admin\AppData\Local\Temp\1dc5cd47accaaebf5be57878d43a2dc0.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2496

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt
Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
1KB

MD5
dbe0977b10c96326a086bcde3474f3a8

SHA1
7b7ce45873510c9b4430d45d7c29f2fcc8764054

SHA256
6a89120ae55769a642c1104f35da7979017b1112d4fd7ef8e7d4b1caad2c30d1

SHA512
401ecc26a3f655ad55dfcc71da9b46f71910c8688504c65c9ed52411353936756234d43a18fe1dd488a912a7963d50ecc32a816b12f5e4ed5546c630a1262cfc

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
131B

MD5
7f03fb134f89a1efb4f21f56c82a4466

SHA1
e9a072772f7ec7306adc763cb708ffa7a157b080

SHA256
da6978beb4e1849ea00f21396ad00d9352b105b770f22c8972fbbe7fc773a0ed

SHA512
8e8aec1052fe60470e707920292a2462a6a3117ef8d98e5395b9bdbde164892121cbad20392e7f9b6d14755be7fd195c555610633c353b1d9b80e59bc6b10eb3

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
653B

MD5
e6058238e320348d0a0c00882124c93d

SHA1
faf7c132fe4ce7c289347b45ee4d0872a1fd6a87

SHA256
5e18662847eee6e0fc654a368d80ddc39bb9a3651628e49b2813568b170aff29

SHA512
c74e2c4f7e58ea94ac633bf4ad17d86e5fa748caa15798e8d4055f3f761793bee29d6f029ca41d098a73928046b4af215654e87e214e4bef2149a94f09007183

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
Filesize
668B

MD5
849fa9da57935afec5fd3fe529cd16c0

SHA1
84508b80f75dc47683cf1c204f2333b2a9348e3d

SHA256
9bc5022f3576f3f2dfbba74cde2011d8fd3242052a53469902a3f352d639789d

SHA512
89eea94fde4ee809c2da980ecaedc8a0964f56f845c3bc11efe5a00bf2403abcc4ecb862be097c426a118406bd89c6be55652ea79039dd9f7434505260ab9ce0

Download Submit
C:\Users\Admin\AppData\Roaming\44\Process.txt
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2496-151-0x0000000006C30000-0x0000000006C38000-memory.dmp

Filesize
32KB

Download
memory/2496-0-0x0000000000E40000-0x0000000001322000-memory.dmp

Filesize
4.9MB

Download
memory/2496-40-0x0000000007770000-0x0000000007D14000-memory.dmp

Filesize
5.6MB

Download
memory/2496-132-0x00000000075D0000-0x0000000007636000-memory.dmp

Filesize
408KB

Download
memory/2496-152-0x0000000007F90000-0x0000000007FB2000-memory.dmp

Filesize
136KB

Download
memory/2496-4-0x0000000006270000-0x0000000006280000-memory.dmp

Filesize
64KB

Download
memory/2496-2-0x0000000000E40000-0x0000000001322000-memory.dmp

Filesize
4.9MB

Download
memory/2496-153-0x0000000007FC0000-0x0000000008314000-memory.dmp

Filesize
3.3MB

Download
memory/2496-1-0x0000000073C90000-0x0000000074440000-memory.dmp

Filesize
7.7MB

Download
memory/2496-39-0x0000000007120000-0x00000000071B2000-memory.dmp

Filesize
584KB

Download
memory/2496-3-0x0000000000E40000-0x0000000001322000-memory.dmp

Filesize
4.9MB

Download
memory/2496-150-0x0000000006C20000-0x0000000006C2A000-memory.dmp

Filesize
40KB

Download
memory/2496-155-0x0000000000E40000-0x0000000001322000-memory.dmp

Filesize
4.9MB

Download
memory/2496-157-0x0000000073C90000-0x0000000074440000-memory.dmp

Filesize
7.7MB

Download
memory/2496-158-0x0000000006270000-0x0000000006280000-memory.dmp

Filesize
64KB

Download
memory/2496-170-0x0000000000E40000-0x0000000001322000-memory.dmp

Filesize
4.9MB

Download
memory/2496-171-0x0000000073C90000-0x0000000074440000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing