Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 04:22
Static task
static1
Behavioral task
behavioral1
Sample
817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe
Resource
win10v2004-20241007-en
General
-
Target
817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe
-
Size
7.7MB
-
MD5
5f8d5770292267bca8c17dd1bf4ecdf2
-
SHA1
debdca02009b642fc15e990fcf286838d8d16cf4
-
SHA256
817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b
-
SHA512
fc28ebd0d216efca4dd0d31b60d29ce0c6e253381825e478dcf1bcb7792ee2b9d26ff2317a09247710504cb3f9d9cd15e88e483c59bfd36884788df43f37e10d
-
SSDEEP
98304:hgl47z3Aldea5a/OhtJeq+4NK+dG7M0mWZsE6+YhU+dbkh4yiMP0T:X/wld79ht+j1M0mWZsE6+YASy10T
Malware Config
Extracted
blackguard
https://api.telegram.org/bot6540906397:AAG08fPgT-V7I17vtz49STaZEuwqXqKshuM/sendMessage?chat_id=5445185021
Signatures
-
BlackGuard
Infostealer first seen in Late 2021.
-
Blackguard family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation VegaStealer_v2.exe -
Executes dropped EXE 3 IoCs
pid Process 4068 AdvegaHack.exe 2036 VegaStealer_v2.exe 2072 v2.exe -
Loads dropped DLL 5 IoCs
pid Process 2072 v2.exe 2072 v2.exe 2072 v2.exe 2072 v2.exe 2072 v2.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ip-api.com 6 freegeoip.app 7 freegeoip.app -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdvegaHack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VegaStealer_v2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language v2.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 v2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier v2.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2072 v2.exe 2072 v2.exe 2072 v2.exe 2072 v2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2072 v2.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1608 wrote to memory of 4068 1608 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe 83 PID 1608 wrote to memory of 4068 1608 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe 83 PID 1608 wrote to memory of 4068 1608 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe 83 PID 1608 wrote to memory of 2036 1608 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe 84 PID 1608 wrote to memory of 2036 1608 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe 84 PID 1608 wrote to memory of 2036 1608 817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe 84 PID 2036 wrote to memory of 2072 2036 VegaStealer_v2.exe 85 PID 2036 wrote to memory of 2072 2036 VegaStealer_v2.exe 85 PID 2036 wrote to memory of 2072 2036 VegaStealer_v2.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe"C:\Users\Admin\AppData\Local\Temp\817cd1a400d6133e5959971d975a5cba0f03f403a2eedeeb4004fd48bc6d367b.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\AdvegaHack.exe"C:\Users\Admin\AppData\Local\Temp\AdvegaHack.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4068
-
-
C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"C:\Users\Admin\AppData\Local\Temp\VegaStealer_v2.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\v2.exe"C:\Users\Admin\AppData\Local\Temp\v2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD526abb9e459e5976f658ce80d6433f1b1
SHA13c8f02c1cf7b8ae82be3deea4b360497f6fee1c3
SHA25660cc77b5d4210cef0a9032908b179142f212155426fdae48055c5f72811f7a12
SHA512c2c02aa1db8036c7309100bb683ec7708fedfb129d763d86e03d9d6adc3688423ec04cb5b596eaf99300787f90d641e53350e1ceed0e8b11d6f29333e04b4ce8
-
Filesize
571KB
MD5169b6d383b7c650ab3ae2129397a6cf3
SHA1fcaef7defb04301fd55fb1421bb15ef96d7040d6
SHA256b896083feb2bdedc1568b62805dbd354c55e57f2d2469a52aec6c98f4ec2dedf
SHA5127a7a7bdb508b8bf177249251c83b65a2ef4a5d8b29397cab130cb8444b23888678673a9a2e4b1c74cc095b358f923b9e7e5a91bfa8c240412d95765851f1dd87
-
Filesize
1.3MB
MD50a1e95b0b1535203a1b8479dff2c03ff
SHA120c4b4406e8a3b1b35ca739ed59aa07ba867043d
SHA256788d748b4d35dfd091626529457d91e9ebc8225746211086b14fb4a25785a51e
SHA512854abcca8d807a98a9ad0ca5d2e55716c3ce26fae7ee4642796baf415c3cfad522b658963eafe504ecaed6c2ecdcdf332c9b01e43dfa342fcc5ca0fbedfe600e
-
Filesize
410KB
MD5056d3fcaf3b1d32ff25f513621e2a372
SHA1851740bca46bab71d0b1d47e47f3eb8358cbee03
SHA25666b64362664030bff1596cda2ec5bd5df48cc7c8313c32f771db4aa30a3f86f9
SHA512ce47c581538f48a46d70279a62c702195beacbfafb48a5a862b3922625fe56f6887d1679c6d9366f946d3d2124cb31c2a3eacbbd14d601ea56e66575cdf46180
-
Filesize
7.7MB
MD59f4f298bcf1d208bd3ce3907cfb28480
SHA105c1cfde951306f8c6e9d484d3d88698c4419c62
SHA256bf7057293d871cac087daab42daf22c1737a1df6adc7b7963989658f3b65f4cc
SHA5124c763c3b6d4884f77083db5ccada59bc57803b3226294eff2ec3db8f2121ac01ee240b0e822cb090f5320ce40df545b477e323efabdbca31722731adc4b46806
-
Filesize
271KB
MD53f62213d184b639a0a62bcb1e65370a8
SHA1bbf50b3c683550684cdb345d348e98fbe2fcafe0
SHA256c692dfc29e70a17cabc19561e8e2662e1fe32fdba998a09fe1a8dc2b7e045b34
SHA5120cd40d714e6a6ebd60cc0c8b0e339905a5f1198a474a531b1794fb562f27053f118718cc68b9652fef3411906f9d8ad22d0253af256fa1922133e9907298e803
-
Filesize
105B
MD52e9d094dda5cdc3ce6519f75943a4ff4
SHA15d989b4ac8b699781681fe75ed9ef98191a5096c
SHA256c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142
SHA512d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7
-
Filesize
739B
MD590109ffe1fcde7e00e75a1b7ac55504b
SHA1521f6fcb56f47310c62ff56a7614448c633359df
SHA256a7effb67eefe15c1578eb1a4b65bd60d1fee8f83b8af3afd3accb9c8eb501229
SHA51244dec2060a4d992e1ffe9f283c4e9028524e0d712b7b3ae6739fcfe5588e358fac64f36cbbbf4385fbbf863a62cf14ca41c5336c7361052a81d7bb5b02b13bcd
-
Filesize
1KB
MD558169eae6ce56b91af8caf0eb3e3184c
SHA1df3bf20f095909eef1c2c8cfb7266b0db76b6dcc
SHA2568dd2f5c39d4c11d44b307147e18fc0f062d1281eff86c6bfd903264370a650f9
SHA5124026574dd680ad3cfeb540e832de741b1e375c46706ae2c7998d576fee99379a1f79ccdf2c3d29d28abeda8d8baf3ba3009ff506fa3a533be8e15e14e27d6bb3