Analysis Overview
SHA256
9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668
Threat Level: Known bad
The file 9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668 was found to be: Known bad.
Malicious Activity Summary
BlackGuard
Blackguard family
Loads dropped DLL
Program crash
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-19 01:33
Signatures
Blackguard family
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-19 01:33
Reported
2024-11-19 01:36
Platform
win7-20240729-en
Max time kernel
122s
Max time network
123s
Command Line
Signatures
BlackGuard
Blackguard family
Loads dropped DLL
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2888 wrote to memory of 2828 | N/A | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe | C:\Windows\SysWOW64\WerFault.exe |
| PID 2888 wrote to memory of 2828 | N/A | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe | C:\Windows\SysWOW64\WerFault.exe |
| PID 2888 wrote to memory of 2828 | N/A | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe | C:\Windows\SysWOW64\WerFault.exe |
| PID 2888 wrote to memory of 2828 | N/A | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe | C:\Windows\SysWOW64\WerFault.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
"C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 792
Network
Files
memory/2888-0-0x0000000074E8E000-0x0000000074E8F000-memory.dmp
memory/2888-1-0x0000000000CE0000-0x0000000000FDC000-memory.dmp
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\inputmanager.dll
| MD5 | 1fd7368d50298c9afe6c12e74ac19589 |
| SHA1 | 3a1ab4d3e2a14854b9e17af5f55d60a9c62a72cc |
| SHA256 | 1a6dd2f79674f2334fca758da41d22045c47332683d7079fae2925d58b61efff |
| SHA512 | c3a45aa0e3fca5e43534e961bf49df8513da0a2edbf9580e8a572d0e4ad51623b9253bf095d37f620a16b8204336eced37e7896482dfc7bd11f9391b45c65c7c |
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\naudio.dll
| MD5 | 047bca47d9d12191811fb2e87cded3aa |
| SHA1 | afdc5d27fb919d1d813e6a07466f889dbc8c6677 |
| SHA256 | bc4bacc3b8b28d898f1671b79f216cca439f95eb60cd32d3e3ecafbecac42780 |
| SHA512 | 99505644d42e4c60c977e4144165ea9dea8f1301e6456aa809e046ecc84a3813a190ce65169a6ffef5a36ad3541ec91002615a02933f8deb642aa3f8f3b11f2f |
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\newtonsoft.json.dll
| MD5 | 6815034209687816d8cf401877ec8133 |
| SHA1 | 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10 |
| SHA256 | 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814 |
| SHA512 | 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721 |
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\simplewpf.dll
| MD5 | 6949b56eefede827d7a82acef8ea303e |
| SHA1 | dccec3108c724a477154099cb970d1a6cbc6f0f5 |
| SHA256 | 108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f |
| SHA512 | 43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e |
\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\smartthreadpool.dll
| MD5 | 05fc040e25e3ee6fe1bc1978deadd87a |
| SHA1 | 86c9656fe1269e571ee87f183cfc637f583efd92 |
| SHA256 | f2b5bc27ee17c866e1e897fd3869227bdc41d3931da77fab2e48bd4d490b8ab7 |
| SHA512 | fd7d0969b20fece2561b22ce1c96a56636cbb51de76e1fa7eb50f0cf8035eecb84bab9b134266c71895356cd7cea869f7b6d49cc71728341e4e83c696000968d |
memory/2888-24-0x0000000074E80000-0x000000007556E000-memory.dmp
memory/2888-28-0x0000000000320000-0x000000000032C000-memory.dmp
memory/2888-31-0x0000000074E80000-0x000000007556E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-19 01:33
Reported
2024-11-19 01:36
Platform
win10v2004-20241007-en
Max time kernel
101s
Max time network
142s
Command Line
Signatures
BlackGuard
Blackguard family
Loads dropped DLL
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe
"C:\Users\Admin\AppData\Local\Temp\9ea3b84c31f0283c8a227c926dc8e37697fec4f6820c111bd7bee4e1c64bf668.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 448 -ip 448
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 1256
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 133.211.185.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.130.81.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 31.243.111.52.in-addr.arpa | udp |
Files
memory/448-0-0x00000000752CE000-0x00000000752CF000-memory.dmp
memory/448-1-0x0000000000820000-0x0000000000B1C000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\inputmanager.dll
| MD5 | 1fd7368d50298c9afe6c12e74ac19589 |
| SHA1 | 3a1ab4d3e2a14854b9e17af5f55d60a9c62a72cc |
| SHA256 | 1a6dd2f79674f2334fca758da41d22045c47332683d7079fae2925d58b61efff |
| SHA512 | c3a45aa0e3fca5e43534e961bf49df8513da0a2edbf9580e8a572d0e4ad51623b9253bf095d37f620a16b8204336eced37e7896482dfc7bd11f9391b45c65c7c |
C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\naudio.dll
| MD5 | 047bca47d9d12191811fb2e87cded3aa |
| SHA1 | afdc5d27fb919d1d813e6a07466f889dbc8c6677 |
| SHA256 | bc4bacc3b8b28d898f1671b79f216cca439f95eb60cd32d3e3ecafbecac42780 |
| SHA512 | 99505644d42e4c60c977e4144165ea9dea8f1301e6456aa809e046ecc84a3813a190ce65169a6ffef5a36ad3541ec91002615a02933f8deb642aa3f8f3b11f2f |
C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\newtonsoft.json.dll
| MD5 | 6815034209687816d8cf401877ec8133 |
| SHA1 | 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10 |
| SHA256 | 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814 |
| SHA512 | 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721 |
C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\simplewpf.dll
| MD5 | 6949b56eefede827d7a82acef8ea303e |
| SHA1 | dccec3108c724a477154099cb970d1a6cbc6f0f5 |
| SHA256 | 108992c9d8aae7ca7db8db951d240b86ae3be26fb06cc2813b629db59cd80d7f |
| SHA512 | 43d3413789415cad525e97441154067a858d0a28f1eb9939c2938e838f0d91a169a11875ab65d17eb642df437e480c3afc74d7e3d3f468d5bd4b0f3eb7f9926e |
C:\Users\Admin\AppData\Local\Temp\Costura\2DBAF1FEDF7B704159B7F064EF200FB9\smartthreadpool.dll
| MD5 | 05fc040e25e3ee6fe1bc1978deadd87a |
| SHA1 | 86c9656fe1269e571ee87f183cfc637f583efd92 |
| SHA256 | f2b5bc27ee17c866e1e897fd3869227bdc41d3931da77fab2e48bd4d490b8ab7 |
| SHA512 | fd7d0969b20fece2561b22ce1c96a56636cbb51de76e1fa7eb50f0cf8035eecb84bab9b134266c71895356cd7cea869f7b6d49cc71728341e4e83c696000968d |
memory/448-29-0x00000000752C0000-0x0000000075A70000-memory.dmp
memory/448-33-0x0000000005B00000-0x0000000005B0C000-memory.dmp
memory/448-36-0x00000000752C0000-0x0000000075A70000-memory.dmp