Malware Analysis Report

2024-11-30 23:22

Sample ID 220415-ckwx5sghap
Target 1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be
SHA256 1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be
Tags
blacknet persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be

Threat Level: Known bad

The file 1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be was found to be: Known bad.

Malicious Activity Summary

blacknet persistence trojan

BlackNET

Executes dropped EXE

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-04-15 02:08

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-04-15 02:08

Reported

2022-04-15 02:19

Platform

win7-20220414-en

Max time kernel

135s

Max time network

46s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe"

Signatures

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe

"C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe"

Network

N/A

Files

memory/1668-54-0x0000000075BF1000-0x0000000075BF3000-memory.dmp

memory/1668-55-0x0000000074E10000-0x00000000753BB000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-04-15 02:08

Reported

2022-04-15 02:19

Platform

win10v2004-20220414-en

Max time kernel

55s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe"

Signatures

BlackNET

trojan blacknet

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe" C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\530aa54a7f8da22dfa9151c567c09315 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe

"C:\Users\Admin\AppData\Local\Temp\1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be.exe"

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 windows-install-update.duckdns.org udp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
NL 8.248.1.254:80 tcp
NL 52.178.17.3:443 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
NL 104.97.14.80:80 tcp
NL 104.97.14.81:80 tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp
RU 95.181.172.241:443 windows-install-update.duckdns.org tcp

Files

memory/924-130-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/924-131-0x0000000004427000-0x0000000004429000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

MD5 283256a5407579a1e28c3fbc7da69d3a
SHA1 54f377035f6b73e6a52d61934fc4e2d3874fd106
SHA256 1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be
SHA512 6442b98fa5e560d2e132709033dd34ac1c4ea7fee84464be70dfce0c93629312f0b19097d9d716acb9cf010fc2285017d6130778771a948f85de9a3854fa13f3

memory/1164-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

MD5 283256a5407579a1e28c3fbc7da69d3a
SHA1 54f377035f6b73e6a52d61934fc4e2d3874fd106
SHA256 1e645b209dd11848c16261490ffe2cf5c8f7a8d854c90f960039609bfb4e97be
SHA512 6442b98fa5e560d2e132709033dd34ac1c4ea7fee84464be70dfce0c93629312f0b19097d9d716acb9cf010fc2285017d6130778771a948f85de9a3854fa13f3

memory/1164-135-0x0000000074620000-0x0000000074BD1000-memory.dmp

memory/1164-136-0x0000000004D47000-0x0000000004D49000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\svchost.exe

MD5 89dd6e72358a669b7d6e2348307a7af7
SHA1 0db348f3c6114a45d71f4d218e0e088b71c7bb0a
SHA256 ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
SHA512 93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b