Analysis
-
max time kernel
41s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
16-04-2024 10:12
General
-
Target
2f1db126393f9fac859569890bb05bf82a9ccc03a46e61d8eb0048d749948b80.exe
-
Size
1.2MB
-
MD5
47c44d12d251014b6a8094b5537e9fe8
-
SHA1
7183573e18f4cd5d88f098791782c4d174960618
-
SHA256
2f1db126393f9fac859569890bb05bf82a9ccc03a46e61d8eb0048d749948b80
-
SHA512
5c0e9473ba20f6f424bec839e7d1795f19ace8ce9a017c8ef051812873a9e9be903e1a1d524a95ad46c20ad8b14e9e4f748004114cd4311c01251d1782554792
-
SSDEEP
24576:ZTXN0zCcPfOqygUl/Qs7exFQlWoC5Bi/r1+gqhKTEBhR86wdMCtMw4Im:VXGz/exZCxl5w/Rnqh/C6pCB
Score
10/10
Malware Config
Extracted
Family
blackguard
C2
https://api.telegram.org/bot7057429288:AAHYl5_27YU1Yjmuj33WKOqLVSgYtq3n-8k/sendMessage?chat_id=6093769937
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f1db126393f9fac859569890bb05bf82a9ccc03a46e61d8eb0048d749948b80.exe"C:\Users\Admin\AppData\Local\Temp\2f1db126393f9fac859569890bb05bf82a9ccc03a46e61d8eb0048d749948b80.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.7MB
-
Filesize
3.7MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
3.7MB
-
Filesize
6.9MB