Overview

overview

10

Static

static

10

a68dd9706c...c8.exe

windows7-x64

10

a68dd9706c...c8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-03-2024 01:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a68dd9706c4f3a3ced390ae00eb19be556bc6c57a1899b6c7ce7381455dd06c8.exe

  • Size

    14.2MB

  • MD5

    0a34726ccc8df4285ef3f19064cd633a

  • SHA1

    bc71524d7034f8707902145d5bf3aa760219deab

  • SHA256

    a68dd9706c4f3a3ced390ae00eb19be556bc6c57a1899b6c7ce7381455dd06c8

  • SHA512

    28a7a3f2da2aecdb8ca0c8c54677a4d480f832e74b173a6bbde25dd0509d009cb2467ca56cec122181178b872987f6b054e08c9aff4ad2dd211f222b16671b2a

  • SSDEEP

    393216:35TkSHry0WyNUHKoc8tQsvcsM+o4YkSdOTByWR:35T9ryx9Hpc8astK9OIU

Score
10/10
blackguardstealer

Malware Config

Signatures

  • BlackGuard

    Infostealer first seen in Late 2021.

    stealerblackguard
  • Program crash 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a68dd9706c4f3a3ced390ae00eb19be556bc6c57a1899b6c7ce7381455dd06c8.exe
    "C:\Users\Admin\AppData\Local\Temp\a68dd9706c4f3a3ced390ae00eb19be556bc6c57a1899b6c7ce7381455dd06c8.exe"
    1⤵
      PID:4880
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1208
        2⤵
        • Program crash
        PID:4772
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1208
        2⤵
        • Program crash
        PID:2140
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4880 -ip 4880
      1⤵
        PID:2076
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4880 -ip 4880
        1⤵
          PID:1972
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:2464

          Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/4880-0-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4880-1-0x0000000000AE0000-0x0000000001922000-memory.dmp

            Filesize

            14.3MB

            Download

          • memory/4880-2-0x0000000006A60000-0x0000000007004000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/4880-3-0x0000000006360000-0x00000000063F2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/4880-4-0x0000000003E10000-0x0000000003E20000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4880-5-0x0000000006340000-0x000000000634A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/4880-6-0x00000000086B0000-0x000000000898A000-memory.dmp

            Filesize

            2.9MB

            Download

          • memory/4880-7-0x0000000074D20000-0x00000000754D0000-memory.dmp

            Filesize

            7.7MB

            Download