Analysis
- max time kernel
30s - max time network
46s - platform
windows7_x64 - resource
win7-20220414-en - submitted
29/04/2022, 01:38
General
- Target b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
- Size 131KB
- Sample220429-b2tcxachdk
- SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
Malware Config
Extracted
-
blacknet
-
v3.5 Public
-
HacKed
-
http://finalb.xyz/NiggaNet
-
BN[RqfcWolJ-7232457]
-
antivm
true
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
df7427b5e05183e625345c3c37ef31c0
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 2 IoCs
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsUpdate.exe
WindowsUpdate.exe
memory/472-87-0x00000000020C6000-0x00000000020E5000-memory.dmp
memory/472-85-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1756-70-0x0000000000C71000-0x0000000000C74000-memory.dmp
memory/1756-72-0x0000000000C8D000-0x0000000000C91000-memory.dmp
memory/1756-61-0x0000000000C75000-0x0000000000C79000-memory.dmp
memory/1756-62-0x0000000000C7D000-0x0000000000C81000-memory.dmp
memory/1756-63-0x0000000000C79000-0x0000000000C7C000-memory.dmp
memory/1756-65-0x0000000000C4B000-0x0000000000C5F000-memory.dmp
memory/1756-66-0x0000000000C79000-0x0000000000C7C000-memory.dmp
memory/1756-67-0x0000000000C67000-0x0000000000C6A000-memory.dmp
memory/1756-64-0x0000000000C79000-0x0000000000C7C000-memory.dmp
memory/1756-68-0x0000000000C81000-0x0000000000C85000-memory.dmp
memory/1756-69-0x0000000000C85000-0x0000000000C89000-memory.dmp
memory/1756-54-0x000007FEF2B00000-0x000007FEF3B96000-memory.dmp
memory/1756-71-0x0000000000C89000-0x0000000000C8D000-memory.dmp
memory/1756-60-0x0000000000C67000-0x0000000000C6A000-memory.dmp
memory/1756-73-0x0000000000C91000-0x0000000000C99000-memory.dmp
memory/1756-74-0x0000000000C4B000-0x0000000000C5F000-memory.dmp
memory/1756-75-0x0000000000C65000-0x0000000000C68000-memory.dmp
memory/1756-76-0x0000000000C6B000-0x0000000000C70000-memory.dmp
memory/1756-77-0x0000000000C4B000-0x0000000000C55000-memory.dmp
memory/1756-78-0x0000000000C5A000-0x0000000000C5F000-memory.dmp
memory/1756-79-0x0000000000C81000-0x0000000000C88000-memory.dmp
memory/1756-80-0x0000000000C87000-0x0000000000C8C000-memory.dmp
memory/1756-81-0x0000000000C52000-0x0000000000C56000-memory.dmp
memory/1756-59-0x0000000000C61000-0x0000000000C64000-memory.dmp
memory/1756-58-0x0000000000C71000-0x0000000000C75000-memory.dmp
memory/1756-57-0x0000000000C6D000-0x0000000000C71000-memory.dmp
memory/1756-56-0x0000000000C26000-0x0000000000C45000-memory.dmp
memory/1756-55-0x000007FEFBA61000-0x000007FEFBA63000-memory.dmp