Analysis
-
max time kernel
102s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 20:40
General
-
Target
Launcher.bin.exe
-
Size
124KB
-
MD5
40c9946204cea15489c3a70b81b5efc4
-
SHA1
a0471872910573f1bb166dd69f3e11ed9eb04ed2
-
SHA256
e39546fbb5714be7f87be265c98286366b4d2cc6cbafe0d4c71bf95da856f118
-
SHA512
04f07054611c2be0a8f36cf6805eb8a39cce0c7c3f1a3ec255569e3fbbf2d4cc89081b579184405ffcc215a7429ba1108736d8ae6841ea380050c0828653ef05
Score
10/10
Malware Config
Extracted
Family
blacknet
Version
v3.6.0 Public
Botnet
Hello
C2
http://141.95.21.84
Mutex
BN[lEBYtSLH-5805348]
Attributes
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
68b4a4f47850fb62cd2157162048241c
-
startup
true
-
usb_spread
false
Signatures
-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
BlackNET Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Launcher.bin.exe"C:\Users\Admin\AppData\Local\Temp\Launcher.bin.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
20KB