3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449

Analysis

max time kernel
136s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:19

Target

SecuriteInfo.com.Trojan-PSW.MSIL.BlackGuard.c.4.3630.exe
Size

6.5MB
MD5

2b82b5601d49184917fb44181c63f594
SHA1

0a52dd49e721a5fe8c86a034c94a6348f1de952a
SHA256

3be37af297b190efb8db29422fb9f74e329db481d55065731a669834daa8a449
SHA512

24818cc1af978c7bb967a39210b544e565a7be5aaa7350793317a850ce4ed212828ae8a8c2482e1edf782d6d571e2f4117ceff93a93c9c12262832f9231ebbf8
SSDEEP

196608:k3Q9SA7QYtLXMnB4lT2MqJctbVNtCxZeSUgj:k3Q9SA8wO4lTYJc9VNtn2j

Score

7^/10

Loads dropped DLL 1 IoCs

Processes:

SecuriteInfo.com.Trojan-PSW.MSIL.BlackGuard.c.4.3630.exe

pid process

1420 SecuriteInfo.com.Trojan-PSW.MSIL.BlackGuard.c.4.3630.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1420	SecuriteInfo.com.Trojan-PSW.MSIL.BlackGuard.c.4.3630.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-PSW.MSIL.BlackGuard.c.4.3630.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan-PSW.MSIL.BlackGuard.c.4.3630.exe"
1⤵
- Loads dropped DLL
PID:1420

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

C:\Users\Admin\AppData\Local\Temp\nsz448D.tmp\LangDLL.dll
Filesize
5KB

MD5
bb3707e7614a444b799d3842bf34b31b

SHA1
e4b75748e417b8a7be3a199150f4338f9d883cca

SHA256
098a384cb4c14b9639db4f4f113426d2a91d170a2affca3e6ecbe57b18d86c38

SHA512
728e7d2a7a555228f24f04829099e5f266f8e3b2f91bc44181c0d08425de158d4c1d61a25c1914bdf0ade43377462169a23b311f7cd110a1e4a07bc781ff25e4

Download Submit