Malware Analysis Report

2024-11-30 23:19

Sample ID 220410-h5r3ksffgr
Target 2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe
SHA256 2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19
Tags
cn32mx blacknet trojan suricata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19

Threat Level: Known bad

The file 2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe was found to be: Known bad.

Malicious Activity Summary

cn32mx blacknet trojan suricata

Blacknet family

Contains code to disable Windows Defender

BlackNET

suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive

BlackNET Payload

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2022-04-10 07:19

Signatures

BlackNET Payload

Description Indicator Process Target
N/A N/A N/A N/A

Blacknet family

blacknet

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-10 07:19

Reported

2022-04-10 07:36

Platform

win7-20220331-en

Max time kernel

132s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe"

Signatures

BlackNET

trojan blacknet

BlackNET Payload

Description Indicator Process Target
N/A N/A N/A N/A

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe

"C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 theblogreader-blog.wtf udp
CA 172.105.27.61:80 theblogreader-blog.wtf tcp
CA 172.105.27.61:80 theblogreader-blog.wtf tcp
US 8.8.8.8:53 theblogreader-blog.wtf udp

Files

memory/528-54-0x0000000000980000-0x00000000009A2000-memory.dmp

memory/528-55-0x000000001B260000-0x000000001B262000-memory.dmp

memory/528-56-0x000000001B269000-0x000000001B288000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-10 07:19

Reported

2022-04-10 07:36

Platform

win10v2004-20220331-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe"

Signatures

BlackNET

trojan blacknet

BlackNET Payload

Description Indicator Process Target
N/A N/A N/A N/A

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

suricata: ET MALWARE Win32/BlackNET CnC Keep-Alive

suricata

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe

"C:\Users\Admin\AppData\Local\Temp\2f5618011959e0ea6248675fe90c7ff13966cfccb5d0d84d46163d0b4814ca19.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 theblogreader-blog.wtf udp
CA 172.105.27.61:80 theblogreader-blog.wtf tcp
US 20.189.173.1:443 tcp
US 8.8.8.8:53 crl4.digicert.com udp
US 93.184.220.29:80 crl4.digicert.com tcp
US 93.184.220.29:80 crl4.digicert.com tcp
US 93.184.220.29:80 crl4.digicert.com tcp
FI 62.115.252.81:80 tcp
FI 62.115.252.81:80 tcp
FI 62.115.252.81:80 tcp
US 93.184.220.29:80 crl4.digicert.com tcp
US 93.184.220.29:5901 crl4.digicert.com tcp
US 93.184.220.29:12298 crl4.digicert.com tcp
US 93.184.220.29:260 crl4.digicert.com tcp
US 93.184.220.29:13362 crl4.digicert.com tcp
US 93.184.220.29:1027 crl4.digicert.com tcp
US 8.8.8.8:53 176.122.125.40.in-addr.arpa udp
US 93.184.220.29:80 crl4.digicert.com tcp
US 8.8.8.8:53 9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa udp
NL 8.238.23.254:60723 ctldl.windowsupdate.com tcp
NL 8.238.23.254:60701 ctldl.windowsupdate.com tcp
NL 8.238.23.254:63650 ctldl.windowsupdate.com tcp
NL 8.238.23.254:9119 ctldl.windowsupdate.com tcp
NL 8.238.23.254:39152 ctldl.windowsupdate.com tcp
NL 8.238.23.254:60378 ctldl.windowsupdate.com tcp
NL 8.238.23.254:20849 ctldl.windowsupdate.com tcp
NL 8.238.23.254:44419 ctldl.windowsupdate.com tcp
NL 8.238.23.254:17468 ctldl.windowsupdate.com tcp
NL 8.238.23.254:54251 ctldl.windowsupdate.com tcp
NL 8.238.23.254:43440 ctldl.windowsupdate.com tcp
NL 8.238.23.254:50954 ctldl.windowsupdate.com tcp
NL 8.238.23.254:18892 ctldl.windowsupdate.com tcp
NL 8.238.23.254:63409 ctldl.windowsupdate.com tcp
NL 8.238.23.254:5019 ctldl.windowsupdate.com tcp
NL 8.238.23.254:41637 ctldl.windowsupdate.com tcp
NL 8.238.23.254:55117 ctldl.windowsupdate.com tcp
NL 8.238.23.254:32597 ctldl.windowsupdate.com tcp
NL 8.238.23.254:43171 ctldl.windowsupdate.com tcp
NL 8.238.23.254:2128 ctldl.windowsupdate.com tcp
NL 8.238.23.254:18042 ctldl.windowsupdate.com tcp
NL 8.238.23.254:3550 ctldl.windowsupdate.com tcp
NL 8.238.23.254:41672 ctldl.windowsupdate.com tcp
NL 8.238.23.254:41048 ctldl.windowsupdate.com tcp
NL 8.238.23.254:37917 ctldl.windowsupdate.com tcp
NL 8.238.23.254:15372 ctldl.windowsupdate.com tcp
NL 8.238.23.254:10670 ctldl.windowsupdate.com tcp
NL 8.238.23.254:39238 ctldl.windowsupdate.com tcp
NL 8.238.23.254:22262 ctldl.windowsupdate.com tcp
NL 8.238.23.254:44157 ctldl.windowsupdate.com tcp
NL 8.238.23.254:30359 ctldl.windowsupdate.com tcp
NL 8.238.23.254:31197 ctldl.windowsupdate.com tcp
NL 8.238.23.254:10411 ctldl.windowsupdate.com tcp
NL 8.238.23.254:47579 ctldl.windowsupdate.com tcp
NL 8.238.23.254:54711 ctldl.windowsupdate.com tcp
NL 8.238.23.254:5299 ctldl.windowsupdate.com tcp
NL 8.238.23.254:61775 ctldl.windowsupdate.com tcp
NL 8.238.23.254:57770 ctldl.windowsupdate.com tcp
NL 8.238.23.254:24752 ctldl.windowsupdate.com tcp
NL 8.238.23.254:809 ctldl.windowsupdate.com tcp
NL 8.238.23.254:39374 ctldl.windowsupdate.com tcp
NL 8.238.23.254:44277 ctldl.windowsupdate.com tcp
US 93.184.220.29:80 crl4.digicert.com tcp
CA 172.105.27.61:80 theblogreader-blog.wtf tcp
US 67.24.25.254:60723 ctldl.windowsupdate.com tcp
US 67.24.25.254:60701 ctldl.windowsupdate.com tcp
US 67.24.25.254:63650 ctldl.windowsupdate.com tcp
US 67.24.25.254:9119 ctldl.windowsupdate.com tcp
US 67.24.25.254:39152 ctldl.windowsupdate.com tcp
US 67.24.25.254:60378 ctldl.windowsupdate.com tcp
US 67.24.25.254:20849 ctldl.windowsupdate.com tcp
US 67.24.25.254:44419 ctldl.windowsupdate.com tcp
US 67.24.25.254:17468 ctldl.windowsupdate.com tcp
US 67.24.25.254:54251 ctldl.windowsupdate.com tcp
US 67.24.25.254:43440 ctldl.windowsupdate.com tcp
US 67.24.25.254:50954 ctldl.windowsupdate.com tcp
US 67.24.25.254:18892 ctldl.windowsupdate.com tcp
US 67.24.25.254:63409 ctldl.windowsupdate.com tcp
US 67.24.25.254:5019 ctldl.windowsupdate.com tcp
US 67.24.25.254:41637 ctldl.windowsupdate.com tcp
US 67.24.25.254:55117 ctldl.windowsupdate.com tcp
US 67.24.25.254:32597 ctldl.windowsupdate.com tcp
US 67.24.25.254:43171 ctldl.windowsupdate.com tcp
US 67.24.25.254:2128 ctldl.windowsupdate.com tcp
US 67.24.25.254:18042 ctldl.windowsupdate.com tcp
US 67.24.25.254:3550 ctldl.windowsupdate.com tcp
US 67.24.25.254:41672 ctldl.windowsupdate.com tcp
US 67.24.25.254:41048 ctldl.windowsupdate.com tcp
US 67.24.25.254:37917 ctldl.windowsupdate.com tcp
US 67.24.25.254:15372 ctldl.windowsupdate.com tcp
US 67.24.25.254:10670 ctldl.windowsupdate.com tcp
US 67.24.25.254:39238 ctldl.windowsupdate.com tcp
US 67.24.25.254:22262 ctldl.windowsupdate.com tcp
US 67.24.25.254:44157 ctldl.windowsupdate.com tcp
US 67.24.25.254:30359 ctldl.windowsupdate.com tcp
US 67.24.25.254:31197 ctldl.windowsupdate.com tcp
US 67.24.25.254:10411 ctldl.windowsupdate.com tcp
US 67.24.25.254:47579 ctldl.windowsupdate.com tcp
US 67.24.25.254:54711 ctldl.windowsupdate.com tcp
US 67.24.25.254:5299 ctldl.windowsupdate.com tcp
US 67.24.25.254:61775 ctldl.windowsupdate.com tcp
US 67.24.25.254:57770 ctldl.windowsupdate.com tcp
US 67.24.25.254:24752 ctldl.windowsupdate.com tcp
US 67.24.25.254:809 ctldl.windowsupdate.com tcp
US 67.24.25.254:39374 ctldl.windowsupdate.com tcp
US 67.24.25.254:44277 ctldl.windowsupdate.com tcp

Files

memory/1528-124-0x00000000003F0000-0x0000000000412000-memory.dmp

memory/1528-125-0x00007FFF9AD60000-0x00007FFF9B821000-memory.dmp

memory/1528-126-0x0000000002500000-0x0000000002502000-memory.dmp