Analysis

  • max time kernel
    60s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15-04-2022 02:08

General

  • Target

    ad23aa6f1afb2b28998e1b6f17d147763a0486a00ba8b88125c41905a3eab0ee.exe

  • Size

    325KB

  • MD5

    08359645bddd0dfb58c44cd2e04031a3

  • SHA1

    3ce31c0da59dd222facd81e2bb3d251165430154

  • SHA256

    ad23aa6f1afb2b28998e1b6f17d147763a0486a00ba8b88125c41905a3eab0ee

  • SHA512

    8321166bc96199634da034ef79e8f51a3e0dd007bb7dc8cdafb45fba75a9e6713c85ee6d14182d7fc49b9df722eb6bb0a3ae249864defa268716c6d8e85a0400

Malware Config

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad23aa6f1afb2b28998e1b6f17d147763a0486a00ba8b88125c41905a3eab0ee.exe
    "C:\Users\Admin\AppData\Local\Temp\ad23aa6f1afb2b28998e1b6f17d147763a0486a00ba8b88125c41905a3eab0ee.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:400
    • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

    Filesize

    325KB

    MD5

    08359645bddd0dfb58c44cd2e04031a3

    SHA1

    3ce31c0da59dd222facd81e2bb3d251165430154

    SHA256

    ad23aa6f1afb2b28998e1b6f17d147763a0486a00ba8b88125c41905a3eab0ee

    SHA512

    8321166bc96199634da034ef79e8f51a3e0dd007bb7dc8cdafb45fba75a9e6713c85ee6d14182d7fc49b9df722eb6bb0a3ae249864defa268716c6d8e85a0400

  • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

    Filesize

    325KB

    MD5

    08359645bddd0dfb58c44cd2e04031a3

    SHA1

    3ce31c0da59dd222facd81e2bb3d251165430154

    SHA256

    ad23aa6f1afb2b28998e1b6f17d147763a0486a00ba8b88125c41905a3eab0ee

    SHA512

    8321166bc96199634da034ef79e8f51a3e0dd007bb7dc8cdafb45fba75a9e6713c85ee6d14182d7fc49b9df722eb6bb0a3ae249864defa268716c6d8e85a0400

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    17KB

    MD5

    89dd6e72358a669b7d6e2348307a7af7

    SHA1

    0db348f3c6114a45d71f4d218e0e088b71c7bb0a

    SHA256

    ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

    SHA512

    93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

  • memory/400-130-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-135-0x0000000000841000-0x0000000000842000-memory.dmp

    Filesize

    4KB

  • memory/400-134-0x0000000000841000-0x0000000000842000-memory.dmp

    Filesize

    4KB

  • memory/400-133-0x0000000000841000-0x0000000000842000-memory.dmp

    Filesize

    4KB

  • memory/400-136-0x0000000000841000-0x0000000000842000-memory.dmp

    Filesize

    4KB

  • memory/400-138-0x0000000000841000-0x0000000000842000-memory.dmp

    Filesize

    4KB

  • memory/400-137-0x0000000000841000-0x0000000000842000-memory.dmp

    Filesize

    4KB

  • memory/400-139-0x00000000753E0000-0x0000000075991000-memory.dmp

    Filesize

    5.7MB

  • memory/400-140-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-141-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-142-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-143-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-144-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-145-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-146-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-147-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-148-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-150-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-151-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-152-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-153-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-149-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-154-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-155-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-156-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-157-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-158-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-159-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-160-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-161-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-162-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-163-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-165-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-164-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-166-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-167-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-168-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-169-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-170-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-171-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-172-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-173-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-174-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-175-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-176-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-178-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-177-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-179-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-180-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-181-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-182-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-183-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-184-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-185-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-186-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-187-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-188-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-189-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-190-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-191-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-192-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-193-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-194-0x0000000000580000-0x00000000005D6000-memory.dmp

    Filesize

    344KB

  • memory/400-1229-0x0000000000DE7000-0x0000000000DE9000-memory.dmp

    Filesize

    8KB

  • memory/1664-1230-0x0000000000000000-mapping.dmp

  • memory/1664-1407-0x00000000753E0000-0x0000000075991000-memory.dmp

    Filesize

    5.7MB

  • memory/1664-2332-0x0000000000987000-0x0000000000989000-memory.dmp

    Filesize

    8KB