Analysis
- max time kernel
51s - max time network
183s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
18/04/2022, 19:24
General
- Target b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
- Size 131KB
- Sample220418-x4lazacebr
- SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
Malware Config
Extracted
-
blacknet
-
v3.5 Public
-
HacKed
-
http://finalb.xyz/NiggaNet
-
BN[RqfcWolJ-7232457]
-
antivm
true
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
df7427b5e05183e625345c3c37ef31c0
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 35 IoCs
- Contains code to disable Windows Defender 35 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Executes dropped EXE 4 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe.log
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
svchosts.exe
svchosts.exe
WindowsUpdate.exe
WindowsUpdate.exe
memory/220-182-0x00000000015EA000-0x00000000015EF000-memory.dmp
memory/220-181-0x00000000015E0000-0x00000000015E2000-memory.dmp
memory/624-198-0x000000000095A000-0x000000000095F000-memory.dmp
memory/624-197-0x0000000000950000-0x0000000000952000-memory.dmp
memory/760-229-0x00000000009A0000-0x00000000009A2000-memory.dmp
memory/760-230-0x00000000009AA000-0x00000000009AF000-memory.dmp
memory/796-206-0x0000000000E0A000-0x0000000000E0F000-memory.dmp
memory/796-205-0x0000000000E00000-0x0000000000E02000-memory.dmp
memory/960-178-0x000000000194A000-0x000000000194F000-memory.dmp
memory/960-177-0x0000000001940000-0x0000000001942000-memory.dmp
memory/1164-174-0x0000000000C8A000-0x0000000000C8F000-memory.dmp
memory/1164-173-0x0000000000C80000-0x0000000000C82000-memory.dmp
memory/1356-154-0x0000000021BF0000-0x0000000021BF3000-memory.dmp
memory/1356-158-0x0000000021BFD000-0x0000000021C00000-memory.dmp
memory/1356-155-0x0000000021BF3000-0x0000000021BF5000-memory.dmp
memory/1356-153-0x000000000181A000-0x000000000181F000-memory.dmp
memory/1356-160-0x0000000021BF1000-0x0000000021BFC000-memory.dmp
memory/1356-150-0x0000000001810000-0x0000000001812000-memory.dmp
memory/1356-161-0x0000000021C00000-0x0000000021C05000-memory.dmp
memory/1356-159-0x0000000021BFD000-0x0000000021BFF000-memory.dmp
memory/1356-156-0x0000000021BF7000-0x0000000021BFA000-memory.dmp
memory/1356-157-0x0000000021BFA000-0x0000000021BFD000-memory.dmp
memory/1668-214-0x00000000016BA000-0x00000000016BF000-memory.dmp
memory/1668-213-0x00000000016B0000-0x00000000016B2000-memory.dmp
memory/2128-238-0x000000000137A000-0x000000000137F000-memory.dmp
memory/2128-237-0x0000000001370000-0x0000000001372000-memory.dmp
memory/2208-221-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2208-222-0x00000000009D0000-0x00000000009E0000-memory.dmp
memory/2388-202-0x00000000013BA000-0x00000000013BF000-memory.dmp
memory/2388-201-0x00000000013B0000-0x00000000013B2000-memory.dmp
memory/2556-194-0x0000000000C4A000-0x0000000000C4F000-memory.dmp
memory/2556-193-0x0000000000C40000-0x0000000000C42000-memory.dmp
memory/2672-210-0x00000000010BA000-0x00000000010BF000-memory.dmp
memory/2672-209-0x00000000010B0000-0x00000000010B2000-memory.dmp
memory/2944-185-0x0000000001330000-0x0000000001340000-memory.dmp
memory/2944-186-0x0000000001330000-0x0000000001340000-memory.dmp
memory/3524-190-0x000000000158A000-0x000000000158F000-memory.dmp
memory/3524-189-0x0000000001580000-0x0000000001582000-memory.dmp
memory/3752-166-0x000000000129A000-0x000000000129F000-memory.dmp
memory/3752-165-0x0000000001290000-0x0000000001292000-memory.dmp
memory/3812-152-0x0000000000862000-0x0000000000864000-memory.dmp
memory/3812-151-0x0000000000860000-0x0000000000862000-memory.dmp
memory/4544-218-0x000000000122A000-0x000000000122F000-memory.dmp
memory/4544-217-0x0000000001220000-0x0000000001222000-memory.dmp
memory/4568-135-0x0000000021A95000-0x0000000021A97000-memory.dmp
memory/4568-133-0x0000000021A9D000-0x0000000021AA0000-memory.dmp
memory/4568-148-0x0000000021AAA000-0x0000000021AAF000-memory.dmp
memory/4568-130-0x0000000001720000-0x0000000001722000-memory.dmp
memory/4568-146-0x0000000021A91000-0x0000000021A94000-memory.dmp
memory/4568-131-0x000000000172A000-0x000000000172F000-memory.dmp
memory/4568-145-0x0000000021AA5000-0x0000000021AAA000-memory.dmp
memory/4568-149-0x0000000021AA4000-0x0000000021AA9000-memory.dmp
memory/4568-134-0x0000000021A93000-0x0000000021A95000-memory.dmp
memory/4568-132-0x0000000021A90000-0x0000000021A93000-memory.dmp
memory/4568-147-0x0000000021A97000-0x0000000021A9F000-memory.dmp
memory/4568-138-0x0000000021AA0000-0x0000000021AA5000-memory.dmp
memory/4568-136-0x0000000021A97000-0x0000000021A9A000-memory.dmp
memory/4568-137-0x0000000021A9A000-0x0000000021A9D000-memory.dmp
memory/5064-234-0x0000000000DEA000-0x0000000000DEF000-memory.dmp
memory/5064-233-0x0000000000DE0000-0x0000000000DE2000-memory.dmp
memory/5088-169-0x0000000000D40000-0x0000000000D42000-memory.dmp
memory/5088-170-0x0000000000D4A000-0x0000000000D4F000-memory.dmp
memory/5108-225-0x00000000007F0000-0x00000000007F2000-memory.dmp
memory/5108-226-0x00000000007FA000-0x00000000007FF000-memory.dmp