blackguard | 503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-04-2024 01:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe
Size

5.0MB
MD5

fce45649aa3ef5df00404301a5e4645b
SHA1

1bcccc4c83ef6edb77dbac6097498dd63abadbe2
SHA256

503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829
SHA512

99e55cccd1572d33f2d5c8f4b66ed18f042e4a191e684fae93dcdf3b280c6a18c2b232d8f17de42a8a31eb90712397735497a609a158c5bcaf95436b7ee8157f
SSDEEP

49152:zbqnJ/6/ovIurSYpmbUDgus06UdyPnnXlPM:zmJS/GVpmMgprvl

Score

10^/10

blackguard stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3012	2476	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 3012	2476	503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe	28
PID 2476 wrote to memory of 3012	2476	503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe	28
PID 2476 wrote to memory of 3012	2476	503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe	28
PID 2476 wrote to memory of 3012	2476	503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe	28

C:\Users\Admin\AppData\Local\Temp\503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe
"C:\Users\Admin\AppData\Local\Temp\503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 716
  2⤵
  - Program crash
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-0-0x0000000000F40000-0x0000000001450000-memory.dmp

Filesize
5.1MB

Download
memory/2476-1-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-2-0x0000000074B60000-0x000000007524E000-memory.dmp

Filesize
6.9MB

Download