Analysis
-
max time kernel
45s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24-02-2024 22:31
General
-
Target
aimstar.exe
-
Size
7.7MB
-
MD5
d7ec7f52738bcacf33d89fb8f1b84e19
-
SHA1
ffed31ec21b973ce896ff03020c972d1fdb18982
-
SHA256
636e70909dfc21703747ce167243327f31be31210107bfd865ad37a7b90e4720
-
SHA512
1128f33463d97e0218fb61c77891d07597d49df28cd322dcf5ac0e4af1be4e40d9e469ac02a98a1790eda433a6d250875e471d63c1040f8bc7cd021f4a4db370
-
SSDEEP
196608:Hi2odc8ACwKlRZFm2avkB0+lsFKKm5Ui+Luw/forAD:HBodbhjbaPcsFZNwAD
Malware Config
Extracted
blackguard
https://api.telegram.org/bot6983151793:AAHNg6Weep9RXr0xtID5GbMp4oUCYfsclrY/sendMessage?chat_id=6591851501
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 47 IoCs
-
Suspicious use of SendNotifyMessage 47 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aimstar.exe"C:\Users\Admin\AppData\Local\Temp\aimstar.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
571KB
MD5169b6d383b7c650ab3ae2129397a6cf3
SHA1fcaef7defb04301fd55fb1421bb15ef96d7040d6
SHA256b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf
SHA5127a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87
-
Filesize
1.3MB
MD50a1e95b0b1535203a1b8479dff2c03ff
SHA120c4b4406e8a3b1b35ca739ed59aa07ba867043d
SHA256788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e
SHA512854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e
-
Filesize
410KB
MD5056d3fcaf3b1d32ff25f513621e2a372
SHA1851740bca46bab71d0b1d47e47f3eb8358cbee03
SHA25666b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9
SHA512ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180
-
Filesize
271KB
MD5ed4ac9e57a79cf611f6a916110f6ddf9
SHA15da7167c7c613bf02cf1aed853a17809a2bd5291
SHA256b7d895134dd03c93c5cc942e702d3a8bfdb4c9c394b8053a9b4968650d249a02
SHA512dff977b0e021a2dfb322f099f6323305270ec1f628763d0b84d0f7dc7ffe75e783eeeacb8c087bbc4325a9a0954c966aa546bf024b66248df66e6fc9622df606
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1KB
MD52f84ea5b0955e9a30c62479c36506f7e
SHA13bf2eba3fd116288eb6e46e44842d54099b98157
SHA25640062aabf295c3473a21a7271851ad83d63bfa91a8e121e1c56d713824fcab74
SHA512bc42d57c7b37c811b319c0248f2f4597dcef4474370a9948fe4c1d4c610aa65cdded32ffcb75e5a133ae6762d340ba354e47f21fff0bd5f3e71bce74047362ad
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
240KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
416KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
132KB
-
Filesize
1.8MB
-
Filesize
296KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
136KB