Analysis
- max time kernel
126s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/04/2024, 01:11
General
- Target 349d39e519547ce0e973f32ff77fbd710eb35a95a974906e1046f0161bfbdaf9.exe
- Size 14.2MB
- Sample240407-bkcc3ahc66
- SHA256 349d39e519547ce0e973f32ff77fbd710eb35a95a974906e1046f0161bfbdaf9
Score
10/10
Malware Config
Signatures
- BlackGuard
Infostealer first seen in Late 2021.
- Program crash 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\349d39e519547ce0e973f32ff77fbd710eb35a95a974906e1046f0161bfbdaf9.exe"C:\Users\Admin\AppData\Local\Temp\349d39e519547ce0e973f32ff77fbd710eb35a95a974906e1046f0161bfbdaf9.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 10962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 10962⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4688 -ip 46881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4688 -ip 46881⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4152 --field-trial-handle=3016,i,1323102786462900035,7687994236215859601,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4688-0-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/4688-1-0x0000000000F10000-0x0000000001D50000-memory.dmp
memory/4688-2-0x0000000006D40000-0x00000000072E4000-memory.dmp
memory/4688-3-0x0000000006790000-0x0000000006822000-memory.dmp
memory/4688-4-0x0000000006780000-0x0000000006790000-memory.dmp
memory/4688-5-0x0000000006770000-0x000000000677A000-memory.dmp
memory/4688-6-0x0000000008990000-0x0000000008C6A000-memory.dmp
memory/4688-7-0x0000000075260000-0x0000000075A10000-memory.dmp