Overview

overview

10

Static

static

10

76844c2401...fa.exe

windows7_x64

10

76844c2401...fa.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    31-07-2021 06:05

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76844c2401ac24b85e662d65f5007dc193e81df6c9493963c8e09de55f98cdfa.exe

  • Size

    45KB

  • MD5

    acea5fb0f0dd0ad6e33cedbaed6fdbd9

  • SHA1

    b8c8d170b78ba0f117fc13ddb1ace03efd2a8b0b

  • SHA256

    76844c2401ac24b85e662d65f5007dc193e81df6c9493963c8e09de55f98cdfa

  • SHA512

    adb12002574276b0357e5971d3fd9c7a9e57a3d34800693ce5f357d09f548051819376f669a1727db363566aa9574b11edb0fec89e55ac5c7df88275ac0f179b

Score
10/10
blacknettrojan

Malware Config

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet
  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76844c2401ac24b85e662d65f5007dc193e81df6c9493963c8e09de55f98cdfa.exe
    "C:\Users\Admin\AppData\Local\Temp\76844c2401ac24b85e662d65f5007dc193e81df6c9493963c8e09de55f98cdfa.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of SetWindowsHookEx
    PID:1640

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation

                          Replay Monitor

                          00:00 00:00

                          Downloads

                          • memory/1640-60-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
                            Filesize

                            4KB

                            Download
                          • memory/1640-62-0x0000000000F60000-0x0000000000F62000-memory.dmp
                            Filesize

                            8KB

                            Download
                          • memory/1640-63-0x0000000000F62000-0x0000000000F63000-memory.dmp
                            Filesize

                            4KB

                            Download
                          • memory/1640-64-0x0000000000F64000-0x0000000000F65000-memory.dmp
                            Filesize

                            4KB

                            Download
                          • memory/1640-65-0x0000000000F69000-0x0000000000F88000-memory.dmp
                            Filesize

                            124KB

                            Download