Analysis
- max time kernel
25s - max time network
144s - platform
windows7_x64 - resource
win7-20220331-en - submitted
01/04/2022, 19:10
General
- Target b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
- Size 131KB
- Sample220401-xvjqsacbep
- SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
Malware Config
Extracted
-
blacknet
-
v3.5 Public
-
HacKed
-
http://finalb.xyz/NiggaNet
-
BN[RqfcWolJ-7232457]
-
antivm
true
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
df7427b5e05183e625345c3c37ef31c0
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 24 IoCs
- Contains code to disable Windows Defender 24 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
svchosts.exe
svchosts.exe
WindowsUpdate.exe
WindowsUpdate.exe
memory/108-126-0x0000000000590000-0x0000000000592000-memory.dmp
memory/108-125-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/108-127-0x0000000000596000-0x00000000005B5000-memory.dmp
memory/848-121-0x0000000001FF1000-0x0000000001FF6000-memory.dmp
memory/848-115-0x0000000001FFB000-0x0000000001FFD000-memory.dmp
memory/848-122-0x0000000001FFD000-0x0000000002000000-memory.dmp
memory/848-120-0x0000000001FEA000-0x0000000001FEF000-memory.dmp
memory/848-119-0x0000000002005000-0x0000000002008000-memory.dmp
memory/848-118-0x000000000200D000-0x0000000002011000-memory.dmp
memory/848-117-0x0000000002009000-0x000000000200D000-memory.dmp
memory/848-116-0x0000000001FFD000-0x0000000002001000-memory.dmp
memory/848-114-0x0000000001FF7000-0x0000000001FF9000-memory.dmp
memory/848-113-0x0000000001FF5000-0x0000000001FF7000-memory.dmp
memory/848-95-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/848-112-0x0000000001FF3000-0x0000000001FF5000-memory.dmp
memory/848-111-0x0000000001FF1000-0x0000000001FF3000-memory.dmp
memory/848-99-0x0000000001FB6000-0x0000000001FD5000-memory.dmp
memory/848-98-0x0000000001FB0000-0x0000000001FB2000-memory.dmp
memory/848-110-0x0000000001FEE000-0x0000000001FF0000-memory.dmp
memory/848-109-0x0000000001FEC000-0x0000000001FEE000-memory.dmp
memory/864-130-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/864-131-0x00000000004D6000-0x00000000004F5000-memory.dmp
memory/896-184-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/932-107-0x0000000000AB0000-0x0000000000AB2000-memory.dmp
memory/932-108-0x0000000000AB6000-0x0000000000AD5000-memory.dmp
memory/932-106-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1076-217-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1164-134-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1164-136-0x0000000000AD6000-0x0000000000AF5000-memory.dmp
memory/1164-135-0x0000000000AD0000-0x0000000000AD2000-memory.dmp
memory/1252-203-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1396-144-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1396-175-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1552-154-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1600-208-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1612-180-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1672-103-0x0000000000306000-0x0000000000325000-memory.dmp
memory/1672-101-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1672-102-0x0000000000300000-0x0000000000302000-memory.dmp
memory/1676-189-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1688-158-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1728-163-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1736-213-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1784-171-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1788-66-0x0000000000629000-0x000000000062D000-memory.dmp
memory/1788-74-0x00000000005FB000-0x00000000005FF000-memory.dmp
memory/1788-86-0x000000000063C000-0x0000000000640000-memory.dmp
memory/1788-70-0x00000000005FE000-0x0000000000606000-memory.dmp
memory/1788-54-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1788-88-0x0000000000629000-0x0000000000634000-memory.dmp
memory/1788-69-0x0000000000609000-0x000000000060F000-memory.dmp
memory/1788-82-0x0000000000611000-0x0000000000614000-memory.dmp
memory/1788-75-0x0000000000602000-0x0000000000607000-memory.dmp
memory/1788-56-0x00000000005D6000-0x00000000005F5000-memory.dmp
memory/1788-65-0x0000000000621000-0x0000000000625000-memory.dmp
memory/1788-77-0x0000000000631000-0x0000000000635000-memory.dmp
memory/1788-72-0x0000000000609000-0x000000000060F000-memory.dmp
memory/1788-67-0x0000000000611000-0x0000000000614000-memory.dmp
memory/1788-68-0x0000000000617000-0x000000000061A000-memory.dmp
memory/1788-89-0x000000001B921000-0x000000001B929000-memory.dmp
memory/1788-57-0x000000000060C000-0x000000000060E000-memory.dmp
memory/1788-80-0x000000001B910000-0x000000001B919000-memory.dmp
memory/1788-73-0x000000000060A000-0x000000000060F000-memory.dmp
memory/1788-55-0x00000000005D0000-0x00000000005D2000-memory.dmp
memory/1788-81-0x000000000060C000-0x000000000060F000-memory.dmp
memory/1788-64-0x000000000061D000-0x0000000000621000-memory.dmp
memory/1788-79-0x0000000000641000-0x0000000000649000-memory.dmp
memory/1788-85-0x0000000000618000-0x0000000000634000-memory.dmp
memory/1788-63-0x0000000000617000-0x0000000000619000-memory.dmp
memory/1788-71-0x0000000000614000-0x0000000000617000-memory.dmp
memory/1788-62-0x0000000000615000-0x0000000000617000-memory.dmp
memory/1788-83-0x0000000000606000-0x000000000060A000-memory.dmp
memory/1788-84-0x00000000005FD000-0x0000000000603000-memory.dmp
memory/1788-78-0x0000000000635000-0x0000000000639000-memory.dmp
memory/1788-61-0x0000000000613000-0x0000000000615000-memory.dmp
memory/1788-76-0x000000000062D000-0x0000000000631000-memory.dmp
memory/1788-90-0x000000001B931000-0x000000001B939000-memory.dmp
memory/1788-60-0x0000000000611000-0x0000000000613000-memory.dmp
memory/1788-91-0x000000001B939000-0x000000001B941000-memory.dmp
memory/1788-59-0x000000000060E000-0x0000000000610000-memory.dmp
memory/1788-58-0x000000001B929000-0x000000001B931000-memory.dmp
memory/1788-87-0x000000001B939000-0x000000001B940000-memory.dmp
memory/1852-199-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1908-149-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1924-194-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1960-167-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1968-139-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1968-141-0x0000000000A06000-0x0000000000A25000-memory.dmp
memory/1968-140-0x0000000000A00000-0x0000000000A02000-memory.dmp