blackguard | 1dfb0c02777894980aab7de14a7c4275292f3203073c7757fe22249820f7337e

General

Target

donotwatch.exe
Size

1.6MB
MD5

b3d51f7547f5ca01471dafccce25a7b4
SHA1

f51775c48540a6805ffd0e9a87bab045d5c67c07
SHA256

1dfb0c02777894980aab7de14a7c4275292f3203073c7757fe22249820f7337e
SHA512

8d146f34c9f0f6dd5aa6f828dcc7cb4204b38127751be7391ab966a9884eecc5c3700d1e81bb5fb2f9ef01ed8244a00fbaa4128647e7550bcddf05d927b12dcb
SSDEEP

24576:K5ZWs+OZVEWry8AF7tOmXwksox5SbJAjstImAZiZJyQy3WRzJ/vfBY/rj1SWF:iZB1G8YJZAroXSbJAjmCiJl7vO97F

Score

10^/10

blackguard persistence spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard

Executes dropped EXE 1 IoCs

pid	Process
3032	Skyperr_protected.exe

Loads dropped DLL 5 IoCs

pid	Process
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe
2688	WerFault.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\%Program Files%\\Skyperr_protected.exe\""	Skyperr_protected.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org
4	freegeoip.app
5	freegeoip.app

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3032	Skyperr_protected.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\%Program Files%	donotwatch.exe
File created	C:\Program Files\%Program Files%\__tmp_rar_sfx_access_check_259465371	donotwatch.exe
File created	C:\Program Files\%Program Files%\Skyperr_protected.exe	donotwatch.exe
File opened for modification	C:\Program Files\%Program Files%\Skyperr_protected.exe	donotwatch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2688	3032	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3032	Skyperr_protected.exe
3032	Skyperr_protected.exe
3032	Skyperr_protected.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	Skyperr_protected.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3032	Skyperr_protected.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 3032	2356	donotwatch.exe	30
PID 2356 wrote to memory of 3032	2356	donotwatch.exe	30
PID 2356 wrote to memory of 3032	2356	donotwatch.exe	30
PID 2356 wrote to memory of 3032	2356	donotwatch.exe	30
PID 3032 wrote to memory of 2688	3032	Skyperr_protected.exe	31
PID 3032 wrote to memory of 2688	3032	Skyperr_protected.exe	31
PID 3032 wrote to memory of 2688	3032	Skyperr_protected.exe	31
PID 3032 wrote to memory of 2688	3032	Skyperr_protected.exe	31

C:\Users\Admin\AppData\Local\Temp\donotwatch.exe
"C:\Users\Admin\AppData\Local\Temp\donotwatch.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files\%Program Files%\Skyperr_protected.exe
  "C:\Program Files\%Program Files%\Skyperr_protected.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3032 -s 1204
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\%Program Files%\Skyperr_protected.exe

Filesize
1.2MB

MD5
3b6fc56278c4cc78d120ae23a0dd88c4

SHA1
7c0e2373f5aa592235439067ed2c43599537a524

SHA256
477ef21d4f261a396bce4a66422ae1f36fefca9eb45b142e526eb0f95b6ecf99

SHA512
8c5f0ebcf093f65474cb6bc37a9a8157bb80790b7974d793a10c5f3f83f69db47e5f733566dce06bb96493b9a9a9407e4f4fd12f9516e0a32657638fc7d4ca51

Download Submit
C:\Users\Admin\AppData\Roaming\44\Browsers\Firefox\Bookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
memory/3032-11-0x00000000012A0000-0x0000000001658000-memory.dmp

Filesize
3.7MB

Download
memory/3032-13-0x0000000073D5E000-0x0000000073D5F000-memory.dmp

Filesize
4KB

Download
memory/3032-14-0x00000000012A0000-0x0000000001658000-memory.dmp

Filesize
3.7MB

Download
memory/3032-15-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download
memory/3032-42-0x00000000012A0000-0x0000000001658000-memory.dmp

Filesize
3.7MB

Download
memory/3032-43-0x0000000073D50000-0x000000007443E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads