Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/03/2024, 01:19
General
- Target fe364ddbfe5b0fdd34ca1f2de1f901f8b1097ae9a4d0cee649d3a09e1c02518c.exe
- Size 271KB
- Sample240307-bpx6bscg96
- SHA256 fe364ddbfe5b0fdd34ca1f2de1f901f8b1097ae9a4d0cee649d3a09e1c02518c
Malware Config
Extracted
-
blackguard
-
https://api.telegram.org/bot6791527720:AAGAcaNpEBFqTzq72qgKaCrjniEEB3GQpKo/sendMessage?chat_id=1160270288
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
- Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Detects executables containing common artifacts observed in infostealers 1 IoCs
- Detects executables referencing Discord tokens regular expressions 2 IoCs
- Detects executables referencing credit card regular expressions 2 IoCs
- Detects executables referencing many VPN software clients. Observed in infosteslers 1 IoCs
- Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
- Detects executables using Telegram Chat Bot 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe364ddbfe5b0fdd34ca1f2de1f901f8b1097ae9a4d0cee649d3a09e1c02518c.exe"C:\Users\Admin\AppData\Local\Temp\fe364ddbfe5b0fdd34ca1f2de1f901f8b1097ae9a4d0cee649d3a09e1c02518c.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 22642⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1508 -ip 15081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Bookmarks.txt
Process.txt
Process.txt
Process.txt
Process.txt
memory/1508-3-0x00000000059D0000-0x0000000005A62000-memory.dmp
memory/1508-50-0x0000000006B70000-0x0000000007114000-memory.dmp
memory/1508-49-0x0000000006120000-0x00000000062E2000-memory.dmp
memory/1508-0-0x0000000000710000-0x000000000075A000-memory.dmp
memory/1508-2-0x0000000002BB0000-0x0000000002BC0000-memory.dmp
memory/1508-1-0x0000000074930000-0x00000000750E0000-memory.dmp
memory/1508-142-0x0000000007940000-0x00000000079A6000-memory.dmp
memory/1508-143-0x0000000074930000-0x00000000750E0000-memory.dmp