Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/01/2025, 01:31

General

  • Target

    8ef427c944f45672724985a250b1894cffc411dd2d1e90da7ee1e246b5f52b37.exe

  • Size

    17.4MB

  • MD5

    639fee13dfd16737a84e6c839ae44911

  • SHA1

    b33dc7f76cd265dd1bd4e877a48118235afa470a

  • SHA256

    8ef427c944f45672724985a250b1894cffc411dd2d1e90da7ee1e246b5f52b37

  • SHA512

    e1c1395ccd2b81f20f6508eb10a5ab80c38df7ff666f0246a02f94762e4befb2a8fcb72c24b95eead4cb7f506700226c414819a61ce068a0a58725381ffe2a98

  • SSDEEP

    393216:HnH+my0WyNUHKocdtQsvcsM0wZzRA/Wbo4YkSbOTByWR:HHlyx9Hpcdast85CW87OIU

Malware Config

Signatures

  • BlackGuard

    Infostealer first seen in Late 2021.

  • Blackguard family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ef427c944f45672724985a250b1894cffc411dd2d1e90da7ee1e246b5f52b37.exe
    "C:\Users\Admin\AppData\Local\Temp\8ef427c944f45672724985a250b1894cffc411dd2d1e90da7ee1e246b5f52b37.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2744-0-0x000000007475E000-0x000000007475F000-memory.dmp

    Filesize

    4KB

  • memory/2744-1-0x0000000001320000-0x0000000002498000-memory.dmp

    Filesize

    17.5MB

  • memory/2744-2-0x0000000074750000-0x0000000074E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-3-0x00000000089E0000-0x0000000008CBA000-memory.dmp

    Filesize

    2.9MB

  • memory/2744-4-0x0000000074750000-0x0000000074E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-5-0x0000000074750000-0x0000000074E3E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-6-0x000000007475E000-0x000000007475F000-memory.dmp

    Filesize

    4KB

  • memory/2744-7-0x0000000074750000-0x0000000074E3E000-memory.dmp

    Filesize

    6.9MB