Resubmissions
28-04-2024 22:49
240428-2rygzsbb42 10Analysis
-
max time kernel
27s -
max time network
29s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 22:49
Static task
static1
Behavioral task
behavioral1
Sample
JPoint_exe..scr
Resource
win10v2004-20240419-en
General
-
Target
JPoint_exe..scr
-
Size
29.1MB
-
MD5
3a642521a98b0fbd81443aa9c11f17c3
-
SHA1
a124b3dd773c39af691a616ad36dc4df14c64dfc
-
SHA256
5eecb69d92705c3bf225df3f4adc7965bd73b1c60f49bdf345cf1657a1dba84d
-
SHA512
6c863f1c81c08573b4950fbfa210a49106d7d503a808de8e45f72cb12b326fe84c11124c83d6db59edbf164eb855fa0723d4cbd43f03d6f5a3d80b77d604a964
-
SSDEEP
393216:TCUjvuM6PCZZIPGRVW2GHm3pVO/Gz/goYI4qq0EyEv1B35t1is3z1fr+4fLnjUme:TCJq4uPYHWVO9oyV3n1bz1z+WHFcg
Malware Config
Extracted
blackguard
https://api.telegram.org/bot6757178519:AAEAoqCn5s-kTgxcmCUqE1t4PNO8wKlQVag/sendMessage?chat_id=1328108259
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
JPoint_exe..scrLocalNeiiJnQNpT.exeLocalKxgwwqKxPK..exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation JPoint_exe..scr Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation LocalNeiiJnQNpT.exe Key value queried \REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation LocalKxgwwqKxPK..exe -
Executes dropped EXE 4 IoCs
Processes:
LocalNeiiJnQNpT.exeLocalKxgwwqKxPK..exev2.exeExLoader_Installer.exepid process 5084 LocalNeiiJnQNpT.exe 4804 LocalKxgwwqKxPK..exe 2792 v2.exe 1156 ExLoader_Installer.exe -
Loads dropped DLL 11 IoCs
Processes:
v2.exeExLoader_Installer.exepid process 2792 v2.exe 2792 v2.exe 2792 v2.exe 2792 v2.exe 2792 v2.exe 1156 ExLoader_Installer.exe 1156 ExLoader_Installer.exe 1156 ExLoader_Installer.exe 1156 ExLoader_Installer.exe 1156 ExLoader_Installer.exe 1156 ExLoader_Installer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 freegeoip.app 16 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
v2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 v2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier v2.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
v2.exeExLoader_Installer.exepid process 2792 v2.exe 2792 v2.exe 2792 v2.exe 2792 v2.exe 1156 ExLoader_Installer.exe 1156 ExLoader_Installer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
v2.exedescription pid process Token: SeDebugPrivilege 2792 v2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ExLoader_Installer.exepid process 1156 ExLoader_Installer.exe 1156 ExLoader_Installer.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
JPoint_exe..scrLocalNeiiJnQNpT.exeLocalKxgwwqKxPK..exedescription pid process target process PID 2944 wrote to memory of 5084 2944 JPoint_exe..scr LocalNeiiJnQNpT.exe PID 2944 wrote to memory of 5084 2944 JPoint_exe..scr LocalNeiiJnQNpT.exe PID 2944 wrote to memory of 5084 2944 JPoint_exe..scr LocalNeiiJnQNpT.exe PID 2944 wrote to memory of 4804 2944 JPoint_exe..scr LocalKxgwwqKxPK..exe PID 2944 wrote to memory of 4804 2944 JPoint_exe..scr LocalKxgwwqKxPK..exe PID 5084 wrote to memory of 2792 5084 LocalNeiiJnQNpT.exe v2.exe PID 5084 wrote to memory of 2792 5084 LocalNeiiJnQNpT.exe v2.exe PID 5084 wrote to memory of 2792 5084 LocalNeiiJnQNpT.exe v2.exe PID 4804 wrote to memory of 1156 4804 LocalKxgwwqKxPK..exe ExLoader_Installer.exe PID 4804 wrote to memory of 1156 4804 LocalKxgwwqKxPK..exe ExLoader_Installer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JPoint_exe..scr"C:\Users\Admin\AppData\Local\Temp\JPoint_exe..scr" /S1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\LocalNeiiJnQNpT.exe"C:\Users\Admin\AppData\LocalNeiiJnQNpT.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Users\Admin\AppData\LocalKxgwwqKxPK..exe"C:\Users\Admin\AppData\LocalKxgwwqKxPK..exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.3MB
MD5650a1cce61876f1a3739e398c720893f
SHA1377998a6fb0d5ff55cec8a015cd7c7cf10f555d3
SHA2568ed9a032b5f21c4b12bb76dd191e08af6943083c0619fdb07a8e2fff2c2bae03
SHA512495306321bafc3d85bce9978423828e24d0e71a82d08833cc2b566af5f78a550e72d1962890bc5fb252ef44f103b8fbc6ad90490607d797ea6376ae37e0a7f20
-
Filesize
7.7MB
MD5e5c2b6c60c817774bae0b34af8817eed
SHA1795e04e91de7c453e3079c3c3587115f5c3d4037
SHA2565deb49aa660568188c8e4138c85d4cf5dbae3121bb544ea80ecb360bcfc27086
SHA512a7f07e53177807dbef797bd151ff3f6b760eed8d01a85fc18ecf621b4fd5f6b218fe9152c7567669fced04c5369e7d237b89c3230beca7fe17df7e7e6a1fd75a
-
Filesize
571KB
MD5169b6d383b7c650ab3ae2129397a6cf3
SHA1fcaef7defb04301fd55fb1421bb15ef96d7040d6
SHA256b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf
SHA5127a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87
-
Filesize
183KB
MD595fd1f57da049790723c6011a8bcf9d4
SHA116a1dfd3dd92cdc8a80cd68aa66622a90d41846f
SHA2565a9fe17d41938d555a4c3e53cdc38cde79ce54a6aced83ff65eb7628e353c49c
SHA512da590979b848a7a59dc682fc97f39d6cd6f5defe55222c3e6b4fe0eba9dfae1cb943deedea294691fd9bf8bb03b62627e5961064f9a7d17f9acb4d3c2d744fc4
-
Filesize
116KB
MD5e9b690fbe5c4b96871214379659dd928
SHA1c199a4beac341abc218257080b741ada0fadecaf
SHA256a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
SHA51200cf9b22af6ebbc20d1b9c22fc4261394b7d98ccad4823abc5ca6fdac537b43a00db5b3829c304a85738be5107927c0761c8276d6cb7f80e90f0a2c991dbcd8c
-
Filesize
4.7MB
MD5cb9807f6cf55ad799e920b7e0f97df99
SHA1bb76012ded5acd103adad49436612d073d159b29
SHA2565653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
SHA512f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
-
Filesize
13.8MB
MD59dd98b582f7c7abdb502ce89aa182b58
SHA1c19a63f37f8628c01fafdf905fe7cdfeaaf114f4
SHA256f86e82b9475317faeac418a8aba9ea8432cb0253956b30ed92005043d6c3b3fb
SHA512e5d113a7e9a604a0e89101bb746c31a996806a1f51d9bd111fba30f7673c5b2f439b3b4493454bc9799788d871719a3c11d7a65f594714d1ee6dbfbebf11e9f4
-
Filesize
14KB
MD529b2176e332fcad27b610e65b68d9b25
SHA141e5ce04d4ba90e0c0a0a04277065d4aa9203567
SHA25680f2fb484f4bd47358e6ab0c0b8c0be903ebed49a6342ea6b6ce3c90a731582f
SHA5120e7528b70ee2e024792ba91a535a1a6b93335e4b0845bf000d0e84ca05d68a28390b3d6e47a3ae11cacd6284e6429662597d53b5f2d041553e4c1b2c9b87df7b
-
Filesize
413B
MD5fb1230bb41c3c1290008b9e44059dd39
SHA166493d0f8a6a112d8376cd296b05c277b111dca1
SHA2562429b610ba9010211d18626d311d3dea7274473c2dd50fae833ed739b67b1292
SHA512d5ae9b9124a7c7f8c3d04c4750459c9bc620e3aeb84f5d56a64308eb9b343d4fb62f8b3e03210e04ad90b91bbbb35dd1a56148d06dbcc0872f99e9b1b9d37c7c
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\data\flutter_assets\resources\backgrounds\Ori%20and%20the%20Blind%20Forest.jpg
Filesize93KB
MD5babd1b019be8944f7ef6c64c8194bc8d
SHA1702a50d3e3a0933db4dc1f37423bca3b5c52acde
SHA25671ea07c900e7993072f4896c0ab621303feaf4d13b7c9a4b2993e06122b10f76
SHA5126a854fc0db7206dd182f6ebc594d763b62a75f64663d3e58029cfa2586048838fe8878b043d174923e05f4e3cd2f3e9d96a6dcf5ba8bbd7322bbc3540bbb8b0d
-
Filesize
46KB
MD5e57b6bc24b970a377574124e026a7c01
SHA100184aedd4ee4d2ca6b5c87cf41e78f64304c89b
SHA256b012d85155925bbe2106b20234b96522dec7914f03b09bc6e2fff71554f31bf6
SHA512c162cd8a7130d2c94dac5c3dad58794f368436cbf782e8063c245d4cae405af6aa25c2f381549defd520c3f7cdbc04a27f891798697e9c291317d3b3ba82efdc
-
Filesize
45KB
MD5d10d77b03ba3abe6ccc1c142d9852595
SHA16108edf0cfb3d5f25e3c593949c301c5c2aa5f25
SHA2563c9ef459625f995c62b993b64da299204b741e153ba8e6d988463aaa86b1aa44
SHA51271c4fc3b6f43b4125c5ea5ae09297d72446de81ffc2928fee33aef386754e60dab11cc170c4d6689dd6eeac451f2a57b9d3372278f750dca6ed39ec82fcf9368
-
Filesize
46KB
MD5df63e8855d04ab0e25d2bb6a0b1fabfb
SHA15512dc285f36cdf7da5ba5eabaca128ca3442537
SHA256a728e91375dcadbdf6ef6d7e3cd0bbf5c56fb992d5b1be6640b83214c9d015ed
SHA512eba8afd3289089841e4eda4abd992c2e2020d18d44741733b5a51a2a1e0c0982ffd9da187aa56ba3b891bc259398ec156e08e45265f7218e87eb914794ca69d6
-
Filesize
45KB
MD5d969db6adb881f1dfa91a5b7ec0154d9
SHA1d7b44b20eb246b0ff5c41147c0d0fb96fde47c48
SHA256c7fc6d9f2ff611073fa09a6c61a8c086da0ebe8da841a9f4ec4087a3e9b52152
SHA5122a225a8c12b46aa14e14dd547c6a55c80aef6bfe8cc791dcf60a14ef91994eddc4dec473d856f7c2446d62a41d017d256b64b603d87ae45e75fdeb2230deb5b2
-
Filesize
46KB
MD55177edfb54762b59df676052d11b363d
SHA1fa18815bf4914b93d587c2758b65e234ad51b38b
SHA25650000ce2f0f8bf3018f1d04aa5c6716583b808ca05c802c46a9de4f084a91f7d
SHA5127475fe248eafd528a05acab94f3973eeeb0d169203769ee6b42d007b5fa0605a58a290e145d74d57e17486367bacffed22e4a88e576fa9f65d000e487aa78e27
-
Filesize
201B
MD57f8d672a2849987b498734dcb90f0c51
SHA1e53b9319bf964c15099080ac5497ee39f8bab362
SHA2564a290648cd1cfaaf1db4909d7552ae8cb83cb0b0e36770e64d153ab07ce6e7d4
SHA512b3ddbf719f42440238c55cee896409179b4562ffe74f607d3640f623c8264c2fd2000b085dfd9a25ffd8ba2166695dcd663efec56cdac679f9993cfb602459d4
-
Filesize
1KB
MD5e99140f842b471d330fc27cd73817c4c
SHA19957147463f586824b65bc7bfb121d33a9523a96
SHA2560f4cb470185e3c6c26ae033a3a88e3995340bb08a63432dd9ebb82b73dd665ae
SHA512f579aef41980539675609c62ff4d80dde22bad59917d439dbd4d325173bed3f24534a72e9903aef58c6ee5d4b03fcb7d0a7be8c93c35da6dbb2e1e046b7da0f2
-
Filesize
151B
MD5d47255b6d3e685cac4804eb58207d0b6
SHA17fe02211cf6b77f3971522a3b3888460491ae153
SHA25629bc4875912360fac26586adaca21449026cc2cf6479f9d9bbb066abe2dd2640
SHA512b39c96fd2479585b32146a3b33a5419f665391f1b1857b08896c8254b48fdb733551bd9974a3c7dcfb679cbb5b35ed9b8f538f5c44156d399b02b8d0d4fe95ef
-
Filesize
79KB
MD53577f702479e7f31a32a96f38a36e752
SHA1e407b9ac4cfe3270cdd640a5018bec2178d49bb1
SHA256cc453dfe977598a839a52037ef947388e008e5cdfe91b1f1a4e85afb5509bee2
SHA5121a4a03931ab56c8352382414f55eb25b324e11890d51ba95597dbd867b35db45db5adcefb47d95b3763f413a66e3228e59531bdbd5ba5541469196adb5eb3d70
-
Filesize
798KB
MD5da48e432fe61f451154f0715b2a7b174
SHA151b6add0bbc4e0b5200b01deca5d009f1daf9f39
SHA25665ea729083128dfce1c00726ba932b91aaaf5e48736b5644dd37478e5f2875ac
SHA5125af9c1e43b52536272a575ca400a9eee830a8fcecb83bb1a490515851bef48957d8de669b9f77b8614eb586838af23385e1afce622edb82a90ec7549f882d381
-
Filesize
17.1MB
MD59cc0d19cf87a7ad0eb1064d40042812b
SHA181caa7d244a07f79947f7d35c61816f31bb7b147
SHA2568d40c3ee7110217470a322ce85bbfb5aeda2ec123b057265c4f26da2f679ab1c
SHA5120bc448545372bf841ffe0a49f5cd3b18e88d0cffe849bedb67bc8c500ede61c9c230aec44d4ff478abe4403ed06d978f0e82ec637f1afd5c80e6aaf40c0d3f1b
-
Filesize
559KB
MD5c3d497b0afef4bd7e09c7559e1c75b05
SHA1295998a6455cc230da9517408f59569ea4ed7b02
SHA2561e57a6df9e3742e31a1c6d9bff81ebeeae8a7de3b45a26e5079d5e1cce54cd98
SHA512d5c62fdac7c5ee6b2f84b9bc446d5b10ad1a019e29c653cfdea4d13d01072fdf8da6005ad4817044a86bc664d1644b98a86f31c151a3418be53eb47c1cfae386
-
Filesize
48KB
MD5eb49c1d33b41eb49dfed58aafa9b9a8f
SHA161786eb9f3f996d85a5f5eea4c555093dd0daab6
SHA2566d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
SHA512d15905a3d7203b00181609f47ce6e4b9591a629f2bf26ff33bf964f320371e06d535912fda13987610b76a85c65c659adac62f6b3176dbca91a01374178cd5c6
-
Filesize
1.3MB
MD50a1e95b0b1535203a1b8479dff2c03ff
SHA120c4b4406e8a3b1b35ca739ed59aa07ba867043d
SHA256788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e
SHA512854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e
-
Filesize
410KB
MD5056d3fcaf3b1d32ff25f513621e2a372
SHA1851740bca46bab71d0b1d47e47f3eb8358cbee03
SHA25666b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9
SHA512ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180
-
Filesize
271KB
MD5a3894132a98e32c4d2240890884789c9
SHA1b6a8e8840fd53c6cc214c57b702d0ff21bf3e7f7
SHA25634490ef4ed975183fb977ae970f196beee3d052db95f2d40f26a4c8012043f64
SHA51290eae90e997d2ac0a9298322d2440b58033f6059ec32b3c9b2c3f9620ed3150daad01a269d421a27692051d12f97399a380ec67fd34bb0767c3398763e661223
-
Filesize
269B
MD509b63d7bd61421abdb41e60c1ed56c48
SHA19b7bea3d801af32796cf4704c054a9f3405d4e04
SHA256a748f9cad91d527979fb13f6413ada3c8f6812debbe34fe5804f24a7ca017bd1
SHA5127f754e314599d707a94a94f18743e8b872443ccfe4a3f35021c06fec21db0b6b6439f539ac140859a6ff15cf2619c3930f556c162d2064504236c8daa8763999
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
115B
MD58878f160c769dd4c4493b35665db2d66
SHA11f7900db0cc32b687df4852450560d40d4942b7d
SHA256f8b9665f5774a9072593a1e437ecedf9a4c38a5637e112a3b4bd670ffe3e884c
SHA512d7f6476d1f57721ba94859e644536bdcbf3bf914d812f70ec7eda2c19bc618448b413608ef9e29bf02d11b4f0906b1d7a7a53e4b73e9ccd34b10baef21c709c9
-
Filesize
394B
MD5e4a396fdd17d21cb108f85582663b8f1
SHA104b9dc1720ec9ef5ba71197625726fb08fd9d264
SHA25678fcf8fa85ffb35a9526d11908ef5e813b62672e066b6413db9bb5f861b0b1d9
SHA5125d21dfef1cbdc2ca4370e4e7eeffdc7ed6570bea2bd00165f4cce607eb4bfc0bb87fe016cdf4b9351eb600112cfa74822a802a796496a9f3493ef9e6a75fce38
-
Filesize
840B
MD515b981e62cbb1daea4b995c27471d3d3
SHA1caff26f5f0bec370af9646840a0b22bc8c3c5579
SHA25613e0ed94eba36ff355e4e6cf9103daa50d51b2e234104ec8f2c57e7845ad8195
SHA512a950d7023c0d8e547b4d26e762dae3235dc5dc8e957bcee58830265ed6b8373238b628cd014ba6d3625469bcf18eb5ebe8460af2dabe2e6ab2db77102c1cd84e
-
Filesize
1KB
MD5cef448bd21542b6d3ae61dd7d5b0c9d5
SHA14ac73fbc80b59fa5959dc35adccf8c48267e28f5
SHA2561fa9394b1503134eb64dea19d77305e94a5372a5fc3592dd6ebba24702cc3280
SHA512864aa0aa7ce5c4ed54b364d2b1fa20681aeab737527ed61e775f5a627720010a0c8a401ab08306c723474d196ecf616ce1bd184e05aff3b227b25803a349d138