Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-12-2024 21:24
General
-
Target
VegaStealer_v2.exe
-
Size
7.7MB
-
MD5
9f4f298bcf1d208bd3ce3907cfb28480
-
SHA1
05c1cfde951306f8c6e9d484d3d88698c4419c62
-
SHA256
bf7057293d871cac087daab42daf22c1737a1df6adc7b7963989658f3b65f4cc
-
SHA512
4c763c3b6d4884f77083db5ccada59bc57803b3226294eff2ec3db8f2121ac01ee240b0e822cb090f5320ce40df545b477e323efabdbca31722731adc4b46806
-
SSDEEP
98304:Rgl47z3Aldea5a/OhtJeq+4NK+dG7M0mWZsE6+YhU+dbkh4yiMP0Q:H/wld79ht+j1M0mWZsE6+YASy10Q
Malware Config
Extracted
blackguard
https://api.telegram.org/bot6540906397:AAG08fPgT-V7I17vtz49STaZEuwqXqKshuM/sendMessage?chat_id=5445185021
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Blackguard family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
571KB
MD5169b6d383b7c650ab3ae2129397a6cf3
SHA1fcaef7defb04301fd55fb1421bb15ef96d7040d6
SHA256b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf
SHA5127a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87
-
Filesize
1.3MB
MD50a1e95b0b1535203a1b8479dff2c03ff
SHA120c4b4406e8a3b1b35ca739ed59aa07ba867043d
SHA256788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e
SHA512854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e
-
Filesize
410KB
MD5056d3fcaf3b1d32ff25f513621e2a372
SHA1851740bca46bab71d0b1d47e47f3eb8358cbee03
SHA25666b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9
SHA512ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180
-
Filesize
271KB
MD53f62213d184b639a0a62bcb1e65370a8
SHA1bbf50b3c683550684cdb345d348e98fbe2fcafe0
SHA256c692dfc29e70a17cabc19561e8e2662e1fe32fdba998a09fe1a8dc2b7e045b34
SHA5120cd40d714e6a6ebd60cc0c8b0e339905a5f1198a474a531b1794fb562f27053f118718cc68b9652fef3411906f9d8ad22d0253af256fa1922133e9907298e803
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
718B
MD56a71924cb936a4739428fa433699d2e4
SHA1bc3a0fb7e58d782d734a835de68266afb630ff76
SHA2569083633caf0b605d03f60693426d1dda05cceedd44a7857ca6517dd87aa3b74e
SHA5124c33e53820445838831eb0b0d5230227ea495586814eeea74dc7285b840158234c9eeb129fe89f96fc94478d14b856e9b3aa130ddc3d56b0057af2854ae69f22
-
Filesize
916B
MD5b2b4043696b5307a10dd6ad3ba34a470
SHA1973edd9ae302735c09b11ea0b37edee34209c00d
SHA256307efcced84abafa9182b7ac7075f4fcbf9c99cd6721fa6f858c85d519b2f4da
SHA512c8040f575d4b17bbd80ad444417ba43ea95c4d994e0aa4d84653ce466e02fe36f1f9f169812a4850caeedbf1462668ad3b7d4c35d847e19d260ed21bd4503567
-
Filesize
1KB
MD562eda18e2479a7b325464275b206d635
SHA14ede6206b4403538b85fec66335ece90936e2b86
SHA256382ca30bb97358bd35f657d0352ffaec8a9474c2b0f5bc7ef76b9de97bcfc18c
SHA5126314d63a0e27617c1ddb77dc735fde36dd017b82e6790ff77fdc0e87780f11611752233dc244ef56c4097e18c1915c6d2958c3aa99b88658a0e6c31a2f74456c
-
Filesize
1KB
MD52cb91530bc591a0d63bbd398a0f2f48b
SHA14bdd674aa233f2c3180e983da88223d009059e91
SHA2568fc17421306b1a96218631eea683a7c65487a1da44174593863f2b7effc70db8
SHA5122f71060c5c277c5d35c3e5ffb46e79e1cc85c6b1e5063b25d8a0481217bdb4795bb4d7c440b2531f2c174d1c946a7aceaffda4a9bb175290fc3b7c9a75891796
-
Filesize
1KB
MD53657d1e665995cf835e126c606222f6c
SHA18ba763c321fc2dfbcbf40f22b846efae5a0e86fb
SHA2560b91b3c11b31afd37bdf42464292ecc06ec75cd8f280f00d557a5374d2f33ca5
SHA51233d86ba57fdc83d576e0defc241e1bc72e1f6fedd52a1c21b31b6b355cc057a02b82f598a3373bed3bc65e197d4cb337e926c707719b01e777e9194e96aebf54
-
Filesize
3.3MB
-
Filesize
296KB
-
Filesize
584KB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
240KB
-
Filesize
132KB
-
Filesize
1.8MB
-
Filesize
5.6MB
-
Filesize
416KB
-
Filesize
584KB
-
Filesize
4KB
-
Filesize
136KB
-
Filesize
320KB
-
Filesize
408KB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
7.7MB