Malware Analysis Report

2024-11-30 05:51

Sample ID 241119-bkqkpatkfm
Target 023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a
SHA256 023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a
Tags
blackguard discovery stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a

Threat Level: Known bad

The file 023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a was found to be: Known bad.

Malicious Activity Summary

blackguard discovery stealer

Blackguard family

BlackGuard

Loads dropped DLL

Program crash

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-19 01:12

Signatures

Blackguard family

blackguard

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-19 01:12

Reported

2024-11-19 01:15

Platform

win7-20240903-en

Max time kernel

118s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe"

Signatures

BlackGuard

stealer blackguard

Blackguard family

blackguard

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe

"C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1968 -s 792

Network

N/A

Files

memory/1968-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

memory/1968-1-0x0000000000BF0000-0x0000000000EEC000-memory.dmp

\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\inputmanager.dll

MD5 1fd7368d50298c9afe6c12e74ac19589
SHA1 3a1ab4d3e2a14854b9e17af5f55d60a9c62a72cc
SHA256 1a6dd2f79674f2334fca758da41d22045c47332683d7079fae2925d58b61efff
SHA512 c3a45aa0e3fca5e43534e961bf49df8513da0a2edbf9580e8a572d0e4ad51623b9253bf095d37f620a16b8204336eced37e7896482dfc7bd11f9391b45c65c7c

\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\naudio.dll

MD5 047bca47d9d12191811fb2e87cded3aa
SHA1 afdc5d27fb919d1d813e6a07466f889dbc8c6677
SHA256 bc4bacc3b8b28d898f1671b79f216cca439f95eb60cd32d3e3ecafbecac42780
SHA512 99505644d42e4c60c977e4144165ea9dea8f1301e6456aa809e046ecc84a3813a190ce65169a6ffef5a36ad3541ec91002615a02933f8deb642aa3f8f3b11f2f

\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\newtonsoft.json.dll

MD5 6815034209687816d8cf401877ec8133
SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\simplewpf.dll

MD5 6949b56eefede827d7a82acef8ea303e
SHA1 dccec3108c724a477154099cb970d1a6cbc6f0f5
SHA256 108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f
SHA512 43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e

\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\smartthreadpool.dll

MD5 05fc040e25e3ee6fe1bc1978deadd87a
SHA1 86c9656fe1269e571ee87f183cfc637f583efd92
SHA256 f2b5bc27ee17c866e1e897fd3869227bdc41d3931da77fab2e48bd4d490b8ab7
SHA512 fd7d0969b20fece2561b22ce1c96a56636cbb51de76e1fa7eb50f0cf8035eecb84bab9b134266c71895356cd7cea869f7b6d49cc71728341e4e83c696000968d

memory/1968-24-0x0000000074B80000-0x000000007526E000-memory.dmp

memory/1968-28-0x0000000000570000-0x000000000057C000-memory.dmp

memory/1968-31-0x0000000074B80000-0x000000007526E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-19 01:12

Reported

2024-11-19 01:15

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe"

Signatures

BlackGuard

stealer blackguard

Blackguard family

blackguard

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe

"C:\Users\Admin\AppData\Local\Temp\023db5533a6befbd61d371d2dcd646589944d73f12708b8b6bc085efe012517a.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4672 -ip 4672

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 1256

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

memory/4672-0-0x000000007496E000-0x000000007496F000-memory.dmp

memory/4672-1-0x0000000000E40000-0x000000000113C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\inputmanager.dll

MD5 1fd7368d50298c9afe6c12e74ac19589
SHA1 3a1ab4d3e2a14854b9e17af5f55d60a9c62a72cc
SHA256 1a6dd2f79674f2334fca758da41d22045c47332683d7079fae2925d58b61efff
SHA512 c3a45aa0e3fca5e43534e961bf49df8513da0a2edbf9580e8a572d0e4ad51623b9253bf095d37f620a16b8204336eced37e7896482dfc7bd11f9391b45c65c7c

C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\naudio.dll

MD5 047bca47d9d12191811fb2e87cded3aa
SHA1 afdc5d27fb919d1d813e6a07466f889dbc8c6677
SHA256 bc4bacc3b8b28d898f1671b79f216cca439f95eb60cd32d3e3ecafbecac42780
SHA512 99505644d42e4c60c977e4144165ea9dea8f1301e6456aa809e046ecc84a3813a190ce65169a6ffef5a36ad3541ec91002615a02933f8deb642aa3f8f3b11f2f

C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\newtonsoft.json.dll

MD5 6815034209687816d8cf401877ec8133
SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\simplewpf.dll

MD5 6949b56eefede827d7a82acef8ea303e
SHA1 dccec3108c724a477154099cb970d1a6cbc6f0f5
SHA256 108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f
SHA512 43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e

C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\smartthreadpool.dll

MD5 05fc040e25e3ee6fe1bc1978deadd87a
SHA1 86c9656fe1269e571ee87f183cfc637f583efd92
SHA256 f2b5bc27ee17c866e1e897fd3869227bdc41d3931da77fab2e48bd4d490b8ab7
SHA512 fd7d0969b20fece2561b22ce1c96a56636cbb51de76e1fa7eb50f0cf8035eecb84bab9b134266c71895356cd7cea869f7b6d49cc71728341e4e83c696000968d

memory/4672-29-0x0000000074960000-0x0000000075110000-memory.dmp

memory/4672-33-0x0000000006130000-0x000000000613C000-memory.dmp

memory/4672-36-0x0000000074960000-0x0000000075110000-memory.dmp