blackguard | 09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/01/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe
Size 406KB
Sample260130-cdeqaadz2g
SHA256 09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad
MD5 af460f3fa5a08d0440dced59b36ecb2d
SHA1 d0a3fb55369a15e958ecaf350150d19ad7fde33d
SHA512 c4e62f191053babbbf5c8000b90b8321defa480084e4dd60ca10654f26d8c38d849b57a64510ac0a4bd12ce40611421006ce742c760ce0288bd49224462b694b
SSDEEP 12288:0Ffn47AH5yjHC4IkwC9wTGKidghID2Xg6/x:0F/4Drskw6wTGDdgPXg+
TLSH
T1BE94239C9D3C7933C31062BD094378BB26DD495E174A2E8DB6AF4B1BB63BA1C1313921
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery blackguard growtopia ransomware spyware stealer

Malware Config

Signatures

BlackGuard
Infostealer first seen in Late 2021.
stealer blackguard
Blackguard family
blackguard
Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
Growtopia family
growtopia

Clears Windows event logs 1 TTPs 3 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
864	wevtutil.exe
564	wevtutil.exe
4844	wevtutil.exe

Executes dropped EXE 2 IoCs

pid	Process
4504	Build.exe
1960	undetek-v10.9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ip-api.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Build.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Build.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5020	timeout.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4288	09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe
4288	09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe
4504	Build.exe
4504	Build.exe
4504	Build.exe
4504	Build.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe
Token: SeDebugPrivilege	4504	Build.exe
Token: SeSecurityPrivilege	864	wevtutil.exe
Token: SeBackupPrivilege	864	wevtutil.exe
Token: SeSecurityPrivilege	564	wevtutil.exe
Token: SeBackupPrivilege	564	wevtutil.exe
Token: SeSecurityPrivilege	4844	wevtutil.exe
Token: SeBackupPrivilege	4844	wevtutil.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4504	4288	09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe	79
PID 4288 wrote to memory of 1960	4288	09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe	80
PID 4504 wrote to memory of 864	4504	Build.exe	83
PID 4504 wrote to memory of 564	4504	Build.exe	84
PID 4504 wrote to memory of 4844	4504	Build.exe	86
PID 4504 wrote to memory of 4992	4504	Build.exe	88
PID 4992 wrote to memory of 5020	4992	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe
"C:\Users\Admin\AppData\Local\Temp\09a1b9ec3cd9ca29b584b3702c6825ec17862e3c8c41e47aee3d952631ebe1ad.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Public\Build.exe
  "C:\Users\Public\Build.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil.exe" cl System
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil.exe" cl Application
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- - C:\Windows\SYSTEM32\wevtutil.exe
    "wevtutil.exe" cl Security
    3⤵
    - Clears Windows event logs
    - Suspicious use of AdjustPrivilegeToken
    PID:4844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\cleanup.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\system32\timeout.exe
      timeout /t 3 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5020
- C:\Users\Public\undetek-v10.9.exe
  "C:\Users\Public\undetek-v10.9.exe"
  2⤵
  - Executes dropped EXE
  PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 127B
SHA256 9ca73234a6282c0d6cbee704f91c8a410b2c3e9ab7965834afcbe79ec53e30e8
MD5 3e2fac8ad143a22bdd079a16dd3c8a74
SHA1 97e4feb4b2edc3ba6dfd8e39cb2f4a56d4f6a82f
SHA512 ef58bb6db363d8765bd51a4f2a400c0465a5e31cea60f42bb9f71af552f4258fce26ce522212de628e669f7079c1dd4866eba512f60f66dfee01b4681810eb74
TLSH
T188B02B0311734598044450A3057D304E54BD14C95C0073D0030184AC424143E57836A1
MD5 SHA1 SHA512 TLSH

Submit Download

tmp1ED8.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp1ED8.tmp.dat
Size 224KB
SHA256 2d8571ac33b06ca1bda8b4e494359e692e472987222f5de95eec25a12c853d1f
MD5 516351263bca6c138322eedfe8562bc4
SHA1 77dfdcb950444fec98ca242c05d380a112489aff
SHA512 31c1c26ba3b3f27daa67d049ae0fda61f9707b682004b642783424521232bc9e9f602200ff70559fc33c33151988f43e4c67048f4cbfb973b6d058a2a8567f21
SSDEEP 192:Vno3fT8wRJQnGL11HLfzNSivuvTNN+u/egddCeyv/hVRdbsCEV:C3fQ0JQn6lLfzAivuvBN+wtP2s
TLSH
T10E24540A7B787001DDE3D9725CB080771E3CA16ECF22A6815DB654694DB7853A23D8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1EEA.tmp.dat

Path C:\Users\Admin\AppData\Local\Temp\tmp1EEA.tmp.dat
Size 204KB
SHA256 720685dd6ca97e57e27256ab84b17a2d72519d090a1e54b0196b06ea72e058ee
MD5 4d2ceadf82e4c90d4a69b9d5929b68fd
SHA1 f6e6c46c0bbe0daeb80f7d2033448e4c1fbc835b
SHA512 e30b33fbac285d3967015c3c7425248e6d6f94dd8196a8f749c4561f3c208773b3c94e84d8b95c9b671459a990bc85d0ccb37d814978f0b6935d59c850b8cef5
SSDEEP 96:B9HU+bGz83uxDLjGQLBK31NfR4J+MCXkFr+MFcjtk4Q9/2jdEbjBHMsDETbiIqOp:B90+G83uxXBBK31GkSJYEJH7DNspU
TLSH
T1D414EF0E5F343722CDBD817669E644A35D7CF03F8B5366DA686114B4CEE3652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Build.exe

Path C:\Users\Public\Build.exe
Size 296KB
SHA256 4d1d29a8c94911e6b7ca0e6fa8a90f3d0b93bae12bcb58c95a8d20dc938a42a1
MD5 17e083867c6afb1a1b9430b4697ee029
SHA1 d8509a83f6c755773091d484f88bce964704dc3d
SHA512 57ccb60b7197929d822aedcca18e9fc39e3ed5ce8b4be77edb409a1c1946be76a78abdafabdaccc7d2e8e43e0f028da910bc07c1966220eb01c39766d1117137
SSDEEP 6144:i59IhSQf0Ou8yegCyThvFhIpWbYNoAIIypwC+9bJjU/HIR6pUf:Hh6OTyejyThvFhIpQrAHYR/H7Uf
TLSH
T125545C0127ED465AF2FF5BF8E4B1212583B1B862F83EDB8F6D4464ED1922740D950BA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

undetek-v10.9.exe

Path C:\Users\Public\undetek-v10.9.exe
Size 249KB
SHA256 f578b3da0d66b7d7622561129443418af9afb2bd139064358990021f00642cb9
MD5 264c0497d2829486f2dba3c628d861c7
SHA1 09258505d93507c86c3e366a508948b9c80f3479
SHA512 d5ea3755259c27cb529b466303769456c3e6fa0367ea85354b17a4c6f0a92b3857e45522b941f010d7358bab57a23bd3f4254e0f955f934cef6bc9bde183c1ef
SSDEEP 3072:HabwjW2n2OVKuW9J7N63+KwYaR+aQ3aTnnFBSYvgX3QrVP+7Cr:IunjU/37zkP3SLY3QwCr
TLSH
T145442906B6A994F5D4B2D23AC542257AF6B17C058371E7DF13903A67AF336E0C8393A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4288-0-0x0000000000CE0000-0x0000000000D4A000-memory.dmp

Download

memory/4288-1-0x00000000037C0000-0x00000000037D0000-memory.dmp

Download

memory/4288-2-0x00000000037F0000-0x000000000387E000-memory.dmp

Download

memory/4504-11-0x000001EAC4EF0000-0x000001EAC4F40000-memory.dmp

Download

memory/4504-42-0x000001EAC53D0000-0x000001EAC53E0000-memory.dmp

Download

memory/4504-143-0x000001EAC53D0000-0x000001EAC53E0000-memory.dmp

Download