Analysis
- max time kernel
34s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/04/2022, 07:30
General
- Target b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
- Size 131KB
- Sample220421-jbvr2sabhq
- SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
Malware Config
Extracted
-
blacknet
-
v3.5 Public
-
HacKed
-
http://finalb.xyz/NiggaNet
-
BN[RqfcWolJ-7232457]
-
antivm
true
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
df7427b5e05183e625345c3c37ef31c0
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 30 IoCs
- Contains code to disable Windows Defender 30 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Executes dropped EXE 3 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe.log
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
svchosts.exe
svchosts.exe
WindowsUpdate.exe
WindowsUpdate.exe
memory/360-168-0x0000000000AEA000-0x0000000000AEF000-memory.dmp
memory/360-167-0x0000000000AE0000-0x0000000000AE2000-memory.dmp
memory/428-180-0x000000000188A000-0x000000000188F000-memory.dmp
memory/428-179-0x0000000001880000-0x0000000001882000-memory.dmp
memory/432-240-0x000000000090A000-0x000000000090F000-memory.dmp
memory/432-239-0x0000000000900000-0x0000000000902000-memory.dmp
memory/1076-203-0x0000000001790000-0x0000000001792000-memory.dmp
memory/1076-204-0x000000000179A000-0x000000000179F000-memory.dmp
memory/1276-231-0x0000000001590000-0x0000000001592000-memory.dmp
memory/1276-232-0x000000000159A000-0x000000000159F000-memory.dmp
memory/1436-235-0x0000000001590000-0x0000000001592000-memory.dmp
memory/1436-236-0x000000000159A000-0x000000000159F000-memory.dmp
memory/1564-195-0x00000000006F0000-0x00000000006F2000-memory.dmp
memory/1564-196-0x00000000006FA000-0x00000000006FF000-memory.dmp
memory/1588-219-0x0000000000BC0000-0x0000000000BC2000-memory.dmp
memory/1588-220-0x0000000000BCA000-0x0000000000BCF000-memory.dmp
memory/1600-175-0x0000000001340000-0x0000000001342000-memory.dmp
memory/1600-176-0x000000000134A000-0x000000000134F000-memory.dmp
memory/1640-215-0x0000000000FE0000-0x0000000000FE2000-memory.dmp
memory/1640-216-0x0000000000FEA000-0x0000000000FEF000-memory.dmp
memory/1736-192-0x000000000116A000-0x000000000116F000-memory.dmp
memory/1736-191-0x0000000001160000-0x0000000001162000-memory.dmp
memory/2248-164-0x00000000011CA000-0x00000000011CF000-memory.dmp
memory/2248-163-0x00000000011C0000-0x00000000011C2000-memory.dmp
memory/2848-150-0x0000000020D67000-0x0000000020D6A000-memory.dmp
memory/2848-149-0x0000000020D63000-0x0000000020D65000-memory.dmp
memory/2848-155-0x0000000020D7A000-0x0000000020D7F000-memory.dmp
memory/2848-152-0x0000000020D6D000-0x0000000020D70000-memory.dmp
memory/2848-151-0x0000000020D6A000-0x0000000020D6D000-memory.dmp
memory/2848-153-0x0000000020D70000-0x0000000020D75000-memory.dmp
memory/2848-154-0x0000000020D75000-0x0000000020D7A000-memory.dmp
memory/2848-148-0x0000000020D60000-0x0000000020D63000-memory.dmp
memory/2848-144-0x0000000000BBA000-0x0000000000BBF000-memory.dmp
memory/2848-145-0x0000000000BB0000-0x0000000000BB2000-memory.dmp
memory/3244-199-0x0000000000E90000-0x0000000000E92000-memory.dmp
memory/3244-200-0x0000000000E9A000-0x0000000000E9F000-memory.dmp
memory/3420-171-0x0000000000C40000-0x0000000000C42000-memory.dmp
memory/3420-172-0x0000000000C4A000-0x0000000000C4F000-memory.dmp
memory/3524-188-0x00000000012CA000-0x00000000012CF000-memory.dmp
memory/3524-187-0x00000000012C0000-0x00000000012C2000-memory.dmp
memory/3536-159-0x0000000001710000-0x0000000001712000-memory.dmp
memory/3536-160-0x000000000171A000-0x000000000171F000-memory.dmp
memory/3556-207-0x0000000000970000-0x0000000000972000-memory.dmp
memory/3556-208-0x000000000097A000-0x000000000097F000-memory.dmp
memory/3660-227-0x0000000000BF0000-0x0000000000BF2000-memory.dmp
memory/3660-228-0x0000000000BFA000-0x0000000000BFF000-memory.dmp
memory/3696-212-0x0000000000E5A000-0x0000000000E5F000-memory.dmp
memory/3696-211-0x0000000000E50000-0x0000000000E52000-memory.dmp
memory/3752-183-0x0000000001270000-0x0000000001272000-memory.dmp
memory/3752-184-0x000000000127A000-0x000000000127F000-memory.dmp
memory/4112-134-0x0000000021565000-0x0000000021567000-memory.dmp
memory/4112-132-0x0000000021560000-0x0000000021563000-memory.dmp
memory/4112-136-0x000000002156A000-0x000000002156D000-memory.dmp
memory/4112-130-0x0000000001230000-0x0000000001232000-memory.dmp
memory/4112-135-0x0000000021567000-0x000000002156A000-memory.dmp
memory/4112-131-0x000000000123A000-0x000000000123F000-memory.dmp
memory/4112-133-0x0000000021563000-0x0000000021565000-memory.dmp
memory/4112-137-0x000000002156D000-0x0000000021570000-memory.dmp
memory/4808-244-0x000000000181A000-0x000000000181F000-memory.dmp
memory/4808-243-0x0000000001810000-0x0000000001812000-memory.dmp
memory/4876-146-0x0000000001332000-0x0000000001334000-memory.dmp
memory/4876-147-0x0000000001330000-0x0000000001332000-memory.dmp
memory/5016-223-0x0000000001670000-0x0000000001672000-memory.dmp
memory/5016-224-0x000000000167A000-0x000000000167F000-memory.dmp