blackguard | 9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668

General

Target

9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
Size

3.0MB
MD5

eb552b521cb2d56f4e543138e62e2e54
SHA1

38dce954b6cbd2fa337a6bb8d225a0cf374eed99
SHA256

9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668
SHA512

86d0a96722dfa34028c55aed39e71630d75a0f67029c47872d3b113228a749ac461bbb87c74d05efc43dcc251b7cbada4d43d63ca22ee7d15dee020a011e3c78
SSDEEP

24576:kgWsVRQBzuhK/KyhJev7H/DIrQ+NOS2HMGwHThXNL2PVh6B+BzjmcdTfjfPpWumz:kgWsVRyeKBJev7/IGwH8BzjxzPpq

Score

10^/10

blackguard discovery stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Blackguard family
blackguard

Loads dropped DLL 7 IoCs

Processes:

9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe

pid	process
2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2828 2888 WerFault.exe 9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe

pid	pid_target	process	target process
2828	2888	WerFault.exe	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe

description	pid	process	target process
PID 2888 wrote to memory of 2828	2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe	WerFault.exe
PID 2888 wrote to memory of 2828	2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe	WerFault.exe
PID 2888 wrote to memory of 2828	2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe	WerFault.exe
PID 2888 wrote to memory of 2828	2888	9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
"C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 792
  2⤵
  - Program crash
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\inputmanager.dll

Filesize
20KB

MD5
1fd7368d50298c9afe6c12e74ac19589

SHA1
3a1ab4d3e2a14854b9e17af5f55d60a9c62a72cc

SHA256
1a6dd2f79674f2334fca758da41d22045c47332683d7079fae2925d58b61efff

SHA512
c3a45aa0e3fca5e43534e961bf49df8513da0a2edbf9580e8a572d0e4ad51623b9253bf095d37f620a16b8204336eced37e7896482dfc7bd11f9391b45c65c7c

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\naudio.dll

Filesize
501KB

MD5
047bca47d9d12191811fb2e87cded3aa

SHA1
afdc5d27fb919d1d813e6a07466f889dbc8c6677

SHA256
bc4bacc3b8b28d898f1671b79f216cca439f95eb60cd32d3e3ecafbecac42780

SHA512
99505644d42e4c60c977e4144165ea9dea8f1301e6456aa809e046ecc84a3813a190ce65169a6ffef5a36ad3541ec91002615a02933f8deb642aa3f8f3b11f2f

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\newtonsoft.json.dll

Filesize
683KB

MD5
6815034209687816d8cf401877ec8133

SHA1
1248142eb45eed3beb0d9a2d3b8bed5fe2569b10

SHA256
7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814

SHA512
3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\simplewpf.dll

Filesize
21KB

MD5
6949b56eefede827d7a82acef8ea303e

SHA1
dccec3108c724a477154099cb970d1a6cbc6f0f5

SHA256
108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f

SHA512
43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e

Download Submit
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\smartthreadpool.dll

Filesize
63KB

MD5
05fc040e25e3ee6fe1bc1978deadd87a

SHA1
86c9656fe1269e571ee87f183cfc637f583efd92

SHA256
f2b5bc27ee17c866e1e897fd3869227bdc41d3931da77fab2e48bd4d490b8ab7

SHA512
fd7d0969b20fece2561b22ce1c96a56636cbb51de76e1fa7eb50f0cf8035eecb84bab9b134266c71895356cd7cea869f7b6d49cc71728341e4e83c696000968d

Download Submit
memory/2888-0-0x0000000074E8E000-0x0000000074E8F000-memory.dmp

Filesize
4KB

Download
memory/2888-1-0x0000000000CE0000-0x0000000000FDC000-memory.dmp

Filesize
3.0MB

Download
memory/2888-24-0x0000000074E80000-0x000000007556E000-memory.dmp

Filesize
6.9MB

Download
memory/2888-28-0x0000000000320000-0x000000000032C000-memory.dmp

Filesize
48KB

Download
memory/2888-31-0x0000000074E80000-0x000000007556E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads