blacknet | e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a

Analysis

max time kernel
115s
max time network
16s
platform
windows7_x64
resource
win7v20210410
submitted
01-08-2021 02:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
Size

220KB
MD5

97cb3fda3cff430377a866d6b437de8f
SHA1

2359c8459c1e1dd133c2842b51d2982e63016f92
SHA256

e6507f36045c13dee736bea44d61e90169ea69de61e9dc50b5743960c5b8f85a
SHA512

e192d3afaa093b5b11643aafefa8192cfeb79e5f284e6c757532fd3e2a4a93970f5f8d54b0e983b4c406ced46aee04a99c186f31ff321f9292c51587603c630f

Score

10^/10

blacknet bot evasion persistence trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

Bot

http://furyx.de/panel

Mutex

BN[c1916af6f3a468e5b6f5c7f6b9c78982]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
true

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET Payload 3 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\furz.exe	family_blacknet
C:\Users\Admin\AppData\Local\Temp\furz.exe	family_blacknet
C:\Users\Admin\AppData\Local\Temp\furz.exe	family_blacknet

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\furz.exe	disable_win_def
C:\Users\Admin\AppData\Local\Temp\furz.exe	disable_win_def
C:\Users\Admin\AppData\Local\Temp\furz.exe	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Executes dropped EXE 4 IoCs

Processes:

furz.exeUacTest.exeInpwdja.exeMnrjvryib.exe

pid process

1772 furz.exe
824 UacTest.exe
732 Inpwdja.exe
472 Mnrjvryib.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1392 cmd.exe

pid	process
1772	furz.exe
824	UacTest.exe
732	Inpwdja.exe
472	Mnrjvryib.exe

pid	process
1392	cmd.exe

Loads dropped DLL 6 IoCs

Processes:

E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exeUacTest.exe

pid	process
1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
824	UacTest.exe
824	UacTest.exe
824	UacTest.exe
824	UacTest.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

furz.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features furz.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	furz.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Windows Services = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Update Folder\\Windows Update.exe"	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe

description	pid	process	target process
PID 788 set thread context of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

564 1772 WerFault.exe furz.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1636 taskkill.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1620 reg.exe

pid	pid_target	process	target process
564	1772	WerFault.exe	furz.exe

pid	process
1636	taskkill.exe

pid	process
1620	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

furz.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	furz.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	furz.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

1580 PING.EXE
1452 PING.EXE

pid	process
1580	PING.EXE
1452	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exefurz.exepowershell.exe

pid	process
1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1904	powershell.exe
1904	powershell.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe
1772	furz.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

564 WerFault.exe

pid	process
564	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exetaskkill.exefurz.exepowershell.exeWerFault.exe

description	pid	process
Token: SeDebugPrivilege	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	1772	furz.exe
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeDebugPrivilege	564	WerFault.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

furz.exe

pid process

1772 furz.exe
1772 furz.exe
1772 furz.exe

pid	process
1772	furz.exe
1772	furz.exe
1772	furz.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exeE6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.execmd.exeUacTest.exeInpwdja.exeMnrjvryib.execmd.execmd.execmd.exefurz.exe

description	pid	process	target process
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 788 wrote to memory of 1904	788	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
PID 1904 wrote to memory of 1772	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	furz.exe
PID 1904 wrote to memory of 1772	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	furz.exe
PID 1904 wrote to memory of 1772	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	furz.exe
PID 1904 wrote to memory of 1772	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	furz.exe
PID 1904 wrote to memory of 824	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	UacTest.exe
PID 1904 wrote to memory of 824	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	UacTest.exe
PID 1904 wrote to memory of 824	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	UacTest.exe
PID 1904 wrote to memory of 824	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	UacTest.exe
PID 1904 wrote to memory of 1392	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	cmd.exe
PID 1904 wrote to memory of 1392	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	cmd.exe
PID 1904 wrote to memory of 1392	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	cmd.exe
PID 1904 wrote to memory of 1392	1904	E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe	cmd.exe
PID 1392 wrote to memory of 1580	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1580	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1580	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1580	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1452	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1452	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1452	1392	cmd.exe	PING.EXE
PID 1392 wrote to memory of 1452	1392	cmd.exe	PING.EXE
PID 824 wrote to memory of 732	824	UacTest.exe	Inpwdja.exe
PID 824 wrote to memory of 732	824	UacTest.exe	Inpwdja.exe
PID 824 wrote to memory of 732	824	UacTest.exe	Inpwdja.exe
PID 824 wrote to memory of 732	824	UacTest.exe	Inpwdja.exe
PID 824 wrote to memory of 472	824	UacTest.exe	Mnrjvryib.exe
PID 824 wrote to memory of 472	824	UacTest.exe	Mnrjvryib.exe
PID 824 wrote to memory of 472	824	UacTest.exe	Mnrjvryib.exe
PID 824 wrote to memory of 472	824	UacTest.exe	Mnrjvryib.exe
PID 732 wrote to memory of 1824	732	Inpwdja.exe	cmd.exe
PID 732 wrote to memory of 1824	732	Inpwdja.exe	cmd.exe
PID 732 wrote to memory of 1824	732	Inpwdja.exe	cmd.exe
PID 732 wrote to memory of 1824	732	Inpwdja.exe	cmd.exe
PID 472 wrote to memory of 1544	472	Mnrjvryib.exe	cmd.exe
PID 472 wrote to memory of 1544	472	Mnrjvryib.exe	cmd.exe
PID 472 wrote to memory of 1544	472	Mnrjvryib.exe	cmd.exe
PID 472 wrote to memory of 1544	472	Mnrjvryib.exe	cmd.exe
PID 1824 wrote to memory of 1644	1824	cmd.exe	cmd.exe
PID 1824 wrote to memory of 1644	1824	cmd.exe	cmd.exe
PID 1824 wrote to memory of 1644	1824	cmd.exe	cmd.exe
PID 1644 wrote to memory of 1620	1644	cmd.exe	reg.exe
PID 1644 wrote to memory of 1620	1644	cmd.exe	reg.exe
PID 1644 wrote to memory of 1620	1644	cmd.exe	reg.exe
PID 1544 wrote to memory of 1636	1544	cmd.exe	taskkill.exe
PID 1544 wrote to memory of 1636	1544	cmd.exe	taskkill.exe
PID 1544 wrote to memory of 1636	1544	cmd.exe	taskkill.exe
PID 1544 wrote to memory of 1636	1544	cmd.exe	taskkill.exe
PID 1772 wrote to memory of 1904	1772	furz.exe	powershell.exe
PID 1772 wrote to memory of 1904	1772	furz.exe	powershell.exe
PID 1772 wrote to memory of 1904	1772	furz.exe	powershell.exe
PID 1772 wrote to memory of 1644	1772	furz.exe	schtasks.exe
PID 1772 wrote to memory of 1644	1772	furz.exe	schtasks.exe
PID 1772 wrote to memory of 1644	1772	furz.exe	schtasks.exe
PID 1772 wrote to memory of 564	1772	furz.exe	WerFault.exe
PID 1772 wrote to memory of 564	1772	furz.exe	WerFault.exe
PID 1772 wrote to memory of 564	1772	furz.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
"C:\Users\Admin\AppData\Local\Temp\E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe
  "C:\Users\Admin\AppData\Local\Temp\E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\furz.exe
    "C:\Users\Admin\AppData\Local\Temp\furz.exe"
    3⤵
    - Executes dropped EXE
    - Windows security modification
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1904
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /delete /tn "WindowsUpdate.exe" /f
      4⤵
      PID:1644
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1772 -s 1096
      4⤵
      Program crash
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of AdjustPrivilegeToken
      PID:564
- - C:\Users\Admin\AppData\Local\Temp\UacTest.exe
    "C:\Users\Admin\AppData\Local\Temp\UacTest.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe
      "C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:732
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\13FE.tmp\13FF.tmp\1400.bat C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1824
      - C:\Windows\System32\cmd.exe
        
        C:\Windows\System32\cmd.exe /k C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\System32\reg.exe
        
        C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        Modifies registry key
        
        PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe
      "C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:472
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\141D.tmp\141E.tmp\142E.bat C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1544
      - C:\Windows\SysWOW64\taskkill.exe
        
        Taskkill /IM cmd.exe /F
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 100 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe"& ping 1.1.1.1 -n 1 -w 900 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\E6507F36045C13DEE736BEA44D61E90169EA69DE61E9D.exe"
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 100
      4⤵
      Runs ping.exe
      PID:1580
  - - C:\Windows\SysWOW64\PING.EXE
      ping 1.1.1.1 -n 1 -w 900
      4⤵
      Runs ping.exe
      PID:1452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\13FE.tmp\13FF.tmp\1400.bat

MD5
befbbfdadeef80e445fdd152a121a6d1

SHA1
67019f2a12662f2ff92dc7977769b0debdbf564e

SHA256
0848f1ac65974856844e59ff3b8d492c88acf43f0fd64505d5bf3fd4e43d9da6

SHA512
867c4ee6cb22ba7ba0d5aa9c16d321f36013588b6057e3f3f0e6de670481ab1f7d46c1553b9410ff753de7e923d1b774db0c8297091fd9c852bdc96fee43ee32

Download Submit
C:\Users\Admin\AppData\Local\Temp\141D.tmp\141E.tmp\142E.bat

MD5
4f4ecd10fc86be6be730390c06be67c8

SHA1
4c59c25907109fd48d8d94caaa8b8266ffa3c7c3

SHA256
a9bf329ec3514d7d5698851137d508b763b1a627747b1ce40ddd5c524538459c

SHA512
b4e89c807071e770b9327693032c8d1ebc06811dfeccfe0892e00deb449b75cb5d921ed2f7ae53d3fae00837bd6eed3fcb0bfc7168cad0f0c44997e51e4365f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe

MD5
d1082e6ae11fecd45ebe0f2b3d32230d

SHA1
c070a8395ccb984f5bcd8f22629ffa1b41ea14c1

SHA256
dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77

SHA512
d712276a263e77617838a709e4a8d6b18a676832e909f0ab5547d22a128c309c92dc0f1044c62c0782c3f9f3e2103c08dd9eaf6166f17fd7f0165490e17c0ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Inpwdja.exe

MD5
d1082e6ae11fecd45ebe0f2b3d32230d

SHA1
c070a8395ccb984f5bcd8f22629ffa1b41ea14c1

SHA256
dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77

SHA512
d712276a263e77617838a709e4a8d6b18a676832e909f0ab5547d22a128c309c92dc0f1044c62c0782c3f9f3e2103c08dd9eaf6166f17fd7f0165490e17c0ca3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe

MD5
5303046dacbdfcb013ff016a72311e22

SHA1
deaef4843f0bfcb1bf57a93a9e5ed1c4a7a1e009

SHA256
46618b299010b375a3be43493d14de102180a042f03bdfa1d3290d04feba587a

SHA512
261f76a0c02366ca31ec4e964bb414bf6c42587eea79079beb4b6c66875f565ff925d45722b40c84fdd6ac844dad1d878381f87d8b28af75a98310f534af2b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe

MD5
5303046dacbdfcb013ff016a72311e22

SHA1
deaef4843f0bfcb1bf57a93a9e5ed1c4a7a1e009

SHA256
46618b299010b375a3be43493d14de102180a042f03bdfa1d3290d04feba587a

SHA512
261f76a0c02366ca31ec4e964bb414bf6c42587eea79079beb4b6c66875f565ff925d45722b40c84fdd6ac844dad1d878381f87d8b28af75a98310f534af2b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\UacTest.exe

MD5
7c011f0ea2387f0124c959e3f663cb4d

SHA1
12e668079661c557963236786bb821af4628ee1b

SHA256
6b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4

SHA512
f5770246c943a997c96713a721d512fc0eaf530f3b7d22abe56f50d35b582af4b9f86a65113dee0f09aa7766d257ac0b29a9a56348891339399a2923b399925e

Download Submit
C:\Users\Admin\AppData\Local\Temp\UacTest.exe

MD5
7c011f0ea2387f0124c959e3f663cb4d

SHA1
12e668079661c557963236786bb821af4628ee1b

SHA256
6b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4

SHA512
f5770246c943a997c96713a721d512fc0eaf530f3b7d22abe56f50d35b582af4b9f86a65113dee0f09aa7766d257ac0b29a9a56348891339399a2923b399925e

Download Submit
C:\Users\Admin\AppData\Local\Temp\furz.exe

MD5
b72d429d1d690165c7b0de4a074c4a58

SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565

SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae

SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\furz.exe

MD5
b72d429d1d690165c7b0de4a074c4a58

SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565

SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae

SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c

Download Submit
\Users\Admin\AppData\Local\Temp\Inpwdja.exe

MD5
d1082e6ae11fecd45ebe0f2b3d32230d

SHA1
c070a8395ccb984f5bcd8f22629ffa1b41ea14c1

SHA256
dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77

SHA512
d712276a263e77617838a709e4a8d6b18a676832e909f0ab5547d22a128c309c92dc0f1044c62c0782c3f9f3e2103c08dd9eaf6166f17fd7f0165490e17c0ca3

Download Submit
\Users\Admin\AppData\Local\Temp\Inpwdja.exe

MD5
d1082e6ae11fecd45ebe0f2b3d32230d

SHA1
c070a8395ccb984f5bcd8f22629ffa1b41ea14c1

SHA256
dce696122649ef915c08645cf53e6b118977ce476b076f72d00e3b6f3e309c77

SHA512
d712276a263e77617838a709e4a8d6b18a676832e909f0ab5547d22a128c309c92dc0f1044c62c0782c3f9f3e2103c08dd9eaf6166f17fd7f0165490e17c0ca3

Download Submit
\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe

MD5
5303046dacbdfcb013ff016a72311e22

SHA1
deaef4843f0bfcb1bf57a93a9e5ed1c4a7a1e009

SHA256
46618b299010b375a3be43493d14de102180a042f03bdfa1d3290d04feba587a

SHA512
261f76a0c02366ca31ec4e964bb414bf6c42587eea79079beb4b6c66875f565ff925d45722b40c84fdd6ac844dad1d878381f87d8b28af75a98310f534af2b1b

Download Submit
\Users\Admin\AppData\Local\Temp\Mnrjvryib.exe

MD5
5303046dacbdfcb013ff016a72311e22

SHA1
deaef4843f0bfcb1bf57a93a9e5ed1c4a7a1e009

SHA256
46618b299010b375a3be43493d14de102180a042f03bdfa1d3290d04feba587a

SHA512
261f76a0c02366ca31ec4e964bb414bf6c42587eea79079beb4b6c66875f565ff925d45722b40c84fdd6ac844dad1d878381f87d8b28af75a98310f534af2b1b

Download Submit
\Users\Admin\AppData\Local\Temp\UacTest.exe

MD5
7c011f0ea2387f0124c959e3f663cb4d

SHA1
12e668079661c557963236786bb821af4628ee1b

SHA256
6b69a8fd83ca150642a20128f84cdd2e91aaa6852e705e55e4116caa487903c4

SHA512
f5770246c943a997c96713a721d512fc0eaf530f3b7d22abe56f50d35b582af4b9f86a65113dee0f09aa7766d257ac0b29a9a56348891339399a2923b399925e

Download Submit
\Users\Admin\AppData\Local\Temp\furz.exe

MD5
b72d429d1d690165c7b0de4a074c4a58

SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565

SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae

SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c

Download Submit
memory/472-94-0x0000000000000000-mapping.dmp

Download
memory/564-135-0x0000000000000000-mapping.dmp

Download
memory/564-149-0x00000000005A0000-0x00000000005A1000-memory.dmp

Filesize
4KB

Download
memory/732-95-0x0000000075551000-0x0000000075553000-memory.dmp

Filesize
8KB

Download
memory/732-90-0x0000000000000000-mapping.dmp

Download
memory/788-60-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/788-63-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/788-62-0x0000000004840000-0x0000000004841000-memory.dmp

Filesize
4KB

Download
memory/824-80-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/824-85-0x00000000049B0000-0x00000000049B1000-memory.dmp

Filesize
4KB

Download
memory/824-77-0x0000000000000000-mapping.dmp

Download
memory/1392-82-0x0000000000000000-mapping.dmp

Download
memory/1452-84-0x0000000000000000-mapping.dmp

Download
memory/1544-99-0x0000000000000000-mapping.dmp

Download
memory/1580-83-0x0000000000000000-mapping.dmp

Download
memory/1620-103-0x0000000000000000-mapping.dmp

Download
memory/1636-104-0x0000000000000000-mapping.dmp

Download
memory/1644-101-0x0000000000000000-mapping.dmp

Download
memory/1644-132-0x0000000000000000-mapping.dmp

Download
memory/1772-146-0x000000001B141000-0x000000001B142000-memory.dmp

Filesize
4KB

Download
memory/1772-139-0x000000001B13A000-0x000000001B13B000-memory.dmp

Filesize
4KB

Download
memory/1772-71-0x0000000000000000-mapping.dmp

Download
memory/1772-74-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1772-148-0x000000001B143000-0x000000001B144000-memory.dmp

Filesize
4KB

Download
memory/1772-105-0x000000001B114000-0x000000001B115000-memory.dmp

Filesize
4KB

Download
memory/1772-106-0x000000001B119000-0x000000001B138000-memory.dmp

Filesize
124KB

Download
memory/1772-137-0x000000001B138000-0x000000001B139000-memory.dmp

Filesize
4KB

Download
memory/1772-138-0x000000001B139000-0x000000001B13A000-memory.dmp

Filesize
4KB

Download
memory/1772-86-0x000000001B110000-0x000000001B112000-memory.dmp

Filesize
8KB

Download
memory/1772-140-0x000000001B13B000-0x000000001B13C000-memory.dmp

Filesize
4KB

Download
memory/1772-141-0x000000001B13C000-0x000000001B13D000-memory.dmp

Filesize
4KB

Download
memory/1772-142-0x000000001B13D000-0x000000001B13E000-memory.dmp

Filesize
4KB

Download
memory/1772-143-0x000000001B13E000-0x000000001B13F000-memory.dmp

Filesize
4KB

Download
memory/1772-144-0x000000001B13F000-0x000000001B140000-memory.dmp

Filesize
4KB

Download
memory/1772-145-0x000000001B140000-0x000000001B141000-memory.dmp

Filesize
4KB

Download
memory/1772-87-0x000000001B112000-0x000000001B113000-memory.dmp

Filesize
4KB

Download
memory/1772-147-0x000000001B142000-0x000000001B143000-memory.dmp

Filesize
4KB

Download
memory/1824-97-0x0000000000000000-mapping.dmp

Download
memory/1904-109-0x0000000002360000-0x0000000002361000-memory.dmp

Filesize
4KB

Download
memory/1904-68-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/1904-66-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1904-64-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1904-131-0x000000001ABB0000-0x000000001ABB1000-memory.dmp

Filesize
4KB

Download
memory/1904-130-0x000000001ABA0000-0x000000001ABA1000-memory.dmp

Filesize
4KB

Download
memory/1904-118-0x000000001AB30000-0x000000001AB31000-memory.dmp

Filesize
4KB

Download
memory/1904-65-0x000000000042C00E-mapping.dmp

Download
memory/1904-115-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/1904-114-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/1904-113-0x000000001AC04000-0x000000001AC06000-memory.dmp

Filesize
8KB

Download
memory/1904-112-0x000000001AC00000-0x000000001AC02000-memory.dmp

Filesize
8KB

Download
memory/1904-111-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1904-110-0x000000001AC80000-0x000000001AC81000-memory.dmp

Filesize
4KB

Download
memory/1904-69-0x00000000042D5000-0x00000000042E6000-memory.dmp

Filesize
68KB

Download
memory/1904-108-0x000007FEFBC81000-0x000007FEFBC83000-memory.dmp

Filesize
8KB

Download
memory/1904-107-0x0000000000000000-mapping.dmp

Download