Analysis
- max time kernel
28s - max time network
76s - platform
windows10_x64 - resource
win10v20210408 - submitted
25/08/2021, 00:01
General
- Target 4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f.exe
- Size 76KB
- Sample210825-8q2pmxktlj
- SHA256 4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f
Malware Config
Extracted
-
blacknet
-
v3.6.0 Public
-
HaCk
-
http://gpay-safe.ru/x/
-
BN[vSqieqIW-9794388]
-
antivm
true
-
elevate_uac
false
-
install_name
winhost.exe
-
splitter
|BN|
-
start_name
a5b002eacf54590ec8401ff6d3f920ee
-
startup
true
-
usb_spread
false
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 2 IoCs
- suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f.exe"C:\Users\Admin\AppData\Local\Temp\4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\4054ee21cbfc210489f119c2d717ca1ae43129fc0d07aefe322fabb3b61d079f.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 40003⤵
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\winhost.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\winhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 4000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\winhost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 1.1.1.1 -n 1 -w 40004⤵
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-118-0x000000000263A000-0x000000000263F000-memory.dmp
memory/652-114-0x0000000002630000-0x0000000002632000-memory.dmp
memory/652-115-0x0000000002634000-0x0000000002635000-memory.dmp
memory/652-116-0x0000000002636000-0x0000000002637000-memory.dmp
memory/652-117-0x0000000002639000-0x000000000263A000-memory.dmp
memory/2748-123-0x0000000000D90000-0x0000000000D92000-memory.dmp
memory/2748-125-0x0000000000D94000-0x0000000000D95000-memory.dmp
memory/2748-126-0x0000000000D99000-0x0000000000D9A000-memory.dmp
memory/2748-127-0x0000000000D96000-0x0000000000D97000-memory.dmp
memory/2748-128-0x0000000000D9A000-0x0000000000D9F000-memory.dmp