Overview

overview

10

Static

static

10

b33d569af5...09.exe

windows7_x64

10

b33d569af5...09.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    8s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    28/04/2022, 01:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
  • Size 131KB
  • Sample220428-b2lytsfagp
  • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
  • MD5 SHA1 SHA512
Score
10/10
blacknethackedpersistencetrojan

Malware Config

Extracted

Family

  • blacknet

Version

  • v3.5 Public

Botnet

  • HacKed

C2

  • http://finalb.xyz/NiggaNet

Mutex

  • BN[RqfcWolJ-7232457]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    df7427b5e05183e625345c3c37ef31c0

  • startup

    true

  • usb_spread

    true

aes.plain

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet
  • BlackNET Payload 11 IoCs
  • Contains code to disable Windows Defender 11 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
    "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3624
    • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"
      2⤵
        PID:3432
      • C:\Users\Admin\AppData\Local\Temp\svchosts.exe
        "C:\Users\Admin\AppData\Local\Temp\svchosts.exe"
        2⤵
          PID:2500
          • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
            "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
            3⤵
              PID:1888
            • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
              "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
              3⤵
                PID:3192
              • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                3⤵
                  PID:3428
                • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                  "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                  3⤵
                    PID:2296
                  • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                    "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                    3⤵
                      PID:4776
                    • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                      "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                      3⤵
                        PID:1972
                      • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                        "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                        3⤵
                          PID:1100
                        • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                          "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                          3⤵
                            PID:5048
                          • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                            "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
                            3⤵
                              PID:3692

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe.log
                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0\UsageLogs\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe.log
                              • Size 866B
                              • SHA256 ae5b9b53869ba7b6bf99b07cb09c9ce9ff11d4abbbb626570390f9fba4f6f462
                              • MD5 SHA1 SHA512
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              svchosts.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\svchosts.exe
                              • Size 17KB
                              • SHA256 ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              svchosts.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\svchosts.exe
                              • Size 17KB
                              • SHA256 ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WindowsUpdate.exe
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              WindowsUpdate.exe
                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
                              • Size 131KB
                              • SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              memory/1100-159-0x0000000000B8A000-0x0000000000B8F000-memory.dmp
                              Download

                              memory/1888-141-0x000000000129A000-0x000000000129F000-memory.dmp
                              Download

                              memory/1972-156-0x0000000000A2A000-0x0000000000A2F000-memory.dmp
                              Download

                              memory/2296-150-0x0000000000FFA000-0x0000000000FFF000-memory.dmp
                              Download

                              memory/3192-144-0x0000000000F0A000-0x0000000000F0F000-memory.dmp
                              Download

                              memory/3428-147-0x000000000190A000-0x000000000190F000-memory.dmp
                              Download

                              memory/3432-137-0x0000000000D6A000-0x0000000000D6F000-memory.dmp
                              Download

                              memory/3624-130-0x0000000001A8A000-0x0000000001A8F000-memory.dmp
                              Download

                              memory/4776-153-0x000000000092A000-0x000000000092F000-memory.dmp
                              Download

                              memory/5048-162-0x000000000160A000-0x000000000160F000-memory.dmp
                              Download