Analysis
-
max time kernel
91s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24-02-2024 06:22
General
-
Target
a12988c8c14e8f9738b5a19df4f2fb68.exe
-
Size
1.7MB
-
MD5
a12988c8c14e8f9738b5a19df4f2fb68
-
SHA1
20f006f38129e1ea031566d61b5b45c292e4913f
-
SHA256
f0957b9d77cd4228a0cf2ed601b6392048b299cfb4096382638066b637a4127d
-
SHA512
943193e44c9c46e560e7df4487a39e4e649a19b51574ccf58f3fb31c54e492e41aac4d516fd299611d7f30b6d34166625e0a66b7a05c6020ee32257a06d32838
-
SSDEEP
49152:FVKNPoyN4N09vO/zyAtr3ziUx3IsggbU/COKqt:FV0taCGbyAlx3dK/JZ
Malware Config
Extracted
blackguard
https://api.telegram.org/bot1815441105:AAFl78w0wG00_bQG4toKipjs8EBYjH37y6o/sendMessage?chat_id=548838106
Signatures
-
44Caliber
An open source infostealer written in C#.
-
BlackGuard
Infostealer first seen in Late 2021.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a12988c8c14e8f9738b5a19df4f2fb68.exe"C:\Users\Admin\AppData\Local\Temp\a12988c8c14e8f9738b5a19df4f2fb68.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
1KB
MD515e24f8759475d336b4f98cb9730ecc1
SHA1bc1b2c7f0520e18e784abf54b80e9b15555b99fa
SHA25636f04a8fb38b93720f549d993042d9bc105564646e69a2928a6a10e2a53519af
SHA512993bf4efccb81a11b6a8ed196b0496f2254d8c3dbabcb3526e418d6dea22296cebf07e131e803faa9cbc0b06d4efdc9679af8ab318eb33cd29d23d0254fe8a60
-
Filesize
741B
MD54057ea196faf69ee7427cb9b173a0549
SHA1096460cdce9800f9d02e9c3b50b66ef0abe559ff
SHA2563774a1378bad420622fb142a05396e07e3f9c0348d93e7fec4035f988e77bc0d
SHA512a57bd98cdcd394856b662a84a62570abc850534f18592717486606ec9a2117b5d52b74485bede5e47108abf6f2d98ead8e62dd02c6eb13fd080ed3eb2bdce83a
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
40KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
7.7MB