blackguard | 503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829

Analysis

max time kernel
113s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-04-2024 01:04

Target

503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe
Size

5.0MB
MD5

fce45649aa3ef5df00404301a5e4645b
SHA1

1bcccc4c83ef6edb77dbac6097498dd63abadbe2
SHA256

503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829
SHA512

99e55cccd1572d33f2d5c8f4b66ed18f042e4a191e684fae93dcdf3b280c6a18c2b232d8f17de42a8a31eb90712397735497a609a158c5bcaf95436b7ee8157f
SSDEEP

49152:zbqnJ/6/ovIurSYpmbUDgus06UdyPnnXlPM:zmJS/GVpmMgprvl

Score

10^/10

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
1556	1836	WerFault.exe	89

C:\Users\Admin\AppData\Local\Temp\503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe
"C:\Users\Admin\AppData\Local\Temp\503a514ce51decd9b5cf48f6dd3c5347e14c7503092cedf8881d40001dbe6829.exe"
1⤵
PID:1836
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 1228
  2⤵
  - Program crash
  PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1836 -ip 1836
1⤵
PID:1272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1324

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1836-0-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/1836-1-0x0000000000490000-0x00000000009A0000-memory.dmp

Filesize
5.1MB

Download
memory/1836-2-0x0000000005940000-0x0000000005EE4000-memory.dmp

Filesize
5.6MB

Download
memory/1836-3-0x0000000008EF0000-0x0000000008F82000-memory.dmp

Filesize
584KB

Download
memory/1836-4-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download