Analysis
- max time kernel
119s - max time network
121s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
14/12/2021, 12:18
General
- Target ecd9ab6a47b15527bc306ab61275ea73.dat.exe
- Size 100KB
- Sample211214-pg3bzagfhn
- SHA256 09d34d9a31b852a03000de7f06ee5df53e9af161060a5423ef706cefda4bb5ab
Malware Config
Extracted
-
blacknet
-
v3.7.0 Public
-
ZUHfTJ
-
https://dima1111363.asyx.ru
-
BN[79aec5c26bc4ae83b8cfa57c87d3cef2]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 2 IoCs
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd9ab6a47b15527bc306ab61275ea73.dat.exe"C:\Users\Admin\AppData\Local\Temp\ecd9ab6a47b15527bc306ab61275ea73.dat.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2580 -s 90162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/484-144-0x000000001B053000-0x000000001B054000-memory.dmp
memory/484-145-0x000000001B052000-0x000000001B053000-memory.dmp
memory/484-143-0x000000001B050000-0x000000001B052000-memory.dmp
memory/2580-130-0x000000001D293000-0x000000001D296000-memory.dmp
memory/2580-133-0x000000001D29C000-0x000000001D2A1000-memory.dmp
memory/2580-124-0x000000001D2C6000-0x000000001D2CF000-memory.dmp
memory/2580-125-0x000000001B777000-0x000000001B778000-memory.dmp
memory/2580-127-0x000000001D2E0000-0x000000001D2F1000-memory.dmp
memory/2580-128-0x000000001B77A000-0x000000001B77F000-memory.dmp
memory/2580-126-0x000000001B778000-0x000000001B77A000-memory.dmp
memory/2580-129-0x000000001D290000-0x000000001D293000-memory.dmp
memory/2580-115-0x0000000000A30000-0x0000000000A31000-memory.dmp
memory/2580-132-0x000000001B778000-0x000000001B779000-memory.dmp
memory/2580-131-0x000000001D299000-0x000000001D29C000-memory.dmp
memory/2580-122-0x000000001D2A1000-0x000000001D2A6000-memory.dmp
memory/2580-134-0x000000001D2A6000-0x000000001D2AB000-memory.dmp
memory/2580-135-0x000000001D2AB000-0x000000001D2B4000-memory.dmp
memory/2580-136-0x000000001D2BD000-0x000000001D2C6000-memory.dmp
memory/2580-137-0x000000001D2CF000-0x000000001D2E0000-memory.dmp
memory/2580-123-0x000000001D2B4000-0x000000001D2BD000-memory.dmp
memory/2580-120-0x000000001B775000-0x000000001B777000-memory.dmp
memory/2580-121-0x000000001D296000-0x000000001D299000-memory.dmp
memory/2580-119-0x000000001B772000-0x000000001B773000-memory.dmp
memory/2580-118-0x000000001B773000-0x000000001B774000-memory.dmp
memory/2580-117-0x000000001B770000-0x000000001B772000-memory.dmp