Malware Analysis Report

2024-11-30 23:19

Sample ID 220415-cktssagham
Target a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e
SHA256 a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e
Tags
blacknet persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e

Threat Level: Known bad

The file a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e was found to be: Known bad.

Malicious Activity Summary

blacknet persistence trojan

BlackNET

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-15 02:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-15 02:08

Reported

2022-04-15 02:18

Platform

win7-20220414-en

Max time kernel

148s

Max time network

48s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe

"C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe"

Network

N/A

Files

memory/1624-54-0x0000000075C71000-0x0000000075C73000-memory.dmp

memory/1624-55-0x00000000740B0000-0x000000007465B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-15 02:08

Reported

2022-04-15 02:19

Platform

win10v2004-20220414-en

Max time kernel

78s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe"

Signatures

BlackNET

trojan blacknet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe" C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe

"C:\Users\Admin\AppData\Local\Temp\a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e.exe"

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 windows-install-update.duckdns.org udp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
NL 104.110.191.133:80 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp

Files

memory/4968-130-0x0000000073F00000-0x00000000744B1000-memory.dmp

memory/4968-131-0x0000000003757000-0x0000000003759000-memory.dmp

memory/1124-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

MD5 9fd83afa4f050599f081eaa6b36b380c
SHA1 f062d2cbeaf4395d2335665ad57477c4949b3260
SHA256 a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e
SHA512 62a3f682fcf14eee14537552977f5906f50dd3e29598feaf8c90b285abc7484e432a843e5cf5621d72322e7de35a812b2421e50de2ff1f93dbb66a3daa0b7420

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

MD5 9fd83afa4f050599f081eaa6b36b380c
SHA1 f062d2cbeaf4395d2335665ad57477c4949b3260
SHA256 a6fdf220e34bf901c136a5528548f28da6c71f2cf62e97a07a9ccf8408a06f8e
SHA512 62a3f682fcf14eee14537552977f5906f50dd3e29598feaf8c90b285abc7484e432a843e5cf5621d72322e7de35a812b2421e50de2ff1f93dbb66a3daa0b7420

memory/1124-135-0x0000000073F00000-0x00000000744B1000-memory.dmp

memory/1124-136-0x0000000004097000-0x0000000004099000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 89dd6e72358a669b7d6e2348307a7af7
SHA1 0db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256 ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA512 93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b