Analysis
- max time kernel
8s - max time network
15s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
14/12/2021, 12:17
General
- Target 8f48b9e23d0c7ec5568d8e3dfbf2ec93.dat.exe
- Size 100KB
- Sample211214-pgdzdagfhm
- SHA256 09d34d9a31b852a03000de7f06ee5df53e9af161060a5423ef706cefda4bb5ab
Malware Config
Extracted
-
blacknet
-
v3.7.0 Public
-
ZUHfTJ
-
https://dima1111363.asyx.ru
-
BN[79aec5c26bc4ae83b8cfa57c87d3cef2]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 2 IoCs
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f48b9e23d0c7ec5568d8e3dfbf2ec93.dat.exe"C:\Users\Admin\AppData\Local\Temp\8f48b9e23d0c7ec5568d8e3dfbf2ec93.dat.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"C:\Windows\Microsoft\MyClient\WindowsUpdate.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3468-115-0x00000000003C0000-0x00000000003C1000-memory.dmp
memory/3468-117-0x000000001AFE0000-0x000000001AFE2000-memory.dmp
memory/3468-118-0x000000001AFE3000-0x000000001AFE4000-memory.dmp
memory/3468-119-0x000000001AFE2000-0x000000001AFE3000-memory.dmp
memory/3468-120-0x000000001AFE5000-0x000000001AFE7000-memory.dmp
memory/3468-121-0x000000001AFE7000-0x000000001AFE8000-memory.dmp
memory/3468-122-0x000000001AFEA000-0x000000001AFEF000-memory.dmp
memory/3468-123-0x000000001AFE8000-0x000000001AFEA000-memory.dmp