Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
08-03-2024 03:48
General
-
Target
2692-4-0x000000001BA20000-0x000000001BD68000-memory.exe
-
Size
3.3MB
-
MD5
42cee7c3a7d1704ee390524d2abb263b
-
SHA1
f470ed5779648c629aaa04a71ea1d4d02375d85a
-
SHA256
998fc7c7edce5e45d4ee1d644865032a459cab97f1e700e7cca8b8264ffe0d98
-
SHA512
c540af257f002b37553dcc4d184dc31dddcc500d75957ca1cf718247f91819a9a3f435ccdc9255fb77e36537e08fce5c2f27cff0799c96606d7aebb1e4bab9ab
-
SSDEEP
98304:Q2D5QUcwti78OqJ7TPBsHgMWJ0bJpqcV/:1D5QUcwti7TQlsBWJq1x
Score
10/10
Malware Config
Extracted
Family
blackguard
C2
http://94.142.138.111
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2692-4-0x000000001BA20000-0x000000001BD68000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2692-4-0x000000001BA20000-0x000000001BD68000-memory.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1152 -s 10562⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
712KB
-
Filesize
9.9MB
-
Filesize
512KB