Malware Analysis Report

2024-11-30 23:21

Sample ID 220415-ckr9ysghak
Target b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd
SHA256 b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd
Tags
blacknet persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd

Threat Level: Known bad

The file b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd was found to be: Known bad.

Malicious Activity Summary

blacknet persistence trojan

BlackNET

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-15 02:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-15 02:08

Reported

2022-04-15 02:18

Platform

win7-20220414-en

Max time kernel

149s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe

"C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe"

Network

N/A

Files

memory/536-54-0x0000000075B61000-0x0000000075B63000-memory.dmp

memory/536-55-0x0000000074140000-0x00000000746EB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-15 02:08

Reported

2022-04-15 02:18

Platform

win10v2004-20220414-en

Max time kernel

49s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe"

Signatures

BlackNET

trojan blacknet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe" C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe

"C:\Users\Admin\AppData\Local\Temp\b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd.exe"

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"

Network

Country Destination Domain Proto
GB 91.234.254.131:80 tcp
US 8.8.8.8:53 windows-install-update.duckdns.org udp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
GB 51.132.193.105:443 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
US 93.184.220.29:80 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
FR 2.18.109.224:443 tcp
US 104.18.24.243:80 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
US 8.253.208.112:80 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp

Files

memory/1620-130-0x00000000740D0000-0x0000000074681000-memory.dmp

memory/1620-131-0x0000000003DC7000-0x0000000003DC9000-memory.dmp

memory/3036-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

MD5 a85d38af1a94e238abddb11e66d6f673
SHA1 36c3966ca74f3c4a4f3988717fb701570c70486f
SHA256 b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd
SHA512 6856f1827210ce9ecdb4dd2c503ed5a9cf0774e69a93826fa0e5c0f774186d83161dbe25bbf93397f8fdaf4af0f1699daeaf857cd2c28e717858e0e518ce5092

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

MD5 a85d38af1a94e238abddb11e66d6f673
SHA1 36c3966ca74f3c4a4f3988717fb701570c70486f
SHA256 b666453202660a3a6d28743b422d66ad1f3c02f0eae99c4d9e899ca3eade70fd
SHA512 6856f1827210ce9ecdb4dd2c503ed5a9cf0774e69a93826fa0e5c0f774186d83161dbe25bbf93397f8fdaf4af0f1699daeaf857cd2c28e717858e0e518ce5092

memory/3036-135-0x00000000740D0000-0x0000000074681000-memory.dmp

memory/3036-136-0x00000000037E7000-0x00000000037E9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 89dd6e72358a669b7d6e2348307a7af7
SHA1 0db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256 ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA512 93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b