Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
06-11-2024 19:07
General
-
Target
b66afa684dfdb723047e25ec43141fb0135bbb7c41e66f7d7d2fa9b0f5dc81e1.dll
-
Size
99KB
-
MD5
1c2787555f3212f6cdc130be547ffc03
-
SHA1
96cf5594157848cf52e4aac6b34d20844a68a158
-
SHA256
b66afa684dfdb723047e25ec43141fb0135bbb7c41e66f7d7d2fa9b0f5dc81e1
-
SHA512
c15d7b300ee1aa91cd60407fa93607fdca99f63b94bb3cfe1886940cd4b885fdc7cebaeafbf0af00849883b23e47ff34214b774b829af2c9b3e13c535cbfe39a
-
SSDEEP
1536:mASywOGdA1Tn1ShB5ONqQWApX5nleDaWBnUjBqE8FbYDm:mrb+T1SJHOpX5lTW9UdX8FbYD
Score
10/10
Malware Config
Extracted
Family
blackguard
C2
http://223.5.5.5/resolve?name={0}&short=true&_={1}
http://119.29.29.29/d?dn={0}&_={1}
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Blackguard family
-
Blocklisted process makes network request 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b66afa684dfdb723047e25ec43141fb0135bbb7c41e66f7d7d2fa9b0f5dc81e1.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b66afa684dfdb723047e25ec43141fb0135bbb7c41e66f7d7d2fa9b0f5dc81e1.dll,entry2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
544KB
-
Filesize
64KB
-
Filesize
8KB