Analysis

  • max time kernel
    63s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    29-04-2022 19:37

General

  • Target

    b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

  • Size

    131KB

  • MD5

    c4f79edc4498c5570495bb36fc942134

  • SHA1

    00046b588252502480e8e708a22d25ae1d9b05fa

  • SHA256

    b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

  • SHA512

    07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

Malware Config

Extracted

Family

blacknet

Version

v3.5 Public

Botnet

HacKed

C2

http://finalb.xyz/NiggaNet

Mutex

BN[RqfcWolJ-7232457]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    df7427b5e05183e625345c3c37ef31c0

  • startup

    true

  • usb_spread

    true

aes.plain

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • BlackNET Payload 3 IoCs
  • Contains code to disable Windows Defender 3 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
    "C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3680
    • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:268
      • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe"
        3⤵
          PID:3484
          • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"
            4⤵
              PID:4404
          • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
            dw20.exe -x -s 93992
            3⤵
              PID:2860
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 268 -s 681008
              3⤵
              • Program crash
              PID:3136
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 420 -p 268 -ip 268
          1⤵
            PID:1772

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

            Filesize

            131KB

            MD5

            c4f79edc4498c5570495bb36fc942134

            SHA1

            00046b588252502480e8e708a22d25ae1d9b05fa

            SHA256

            b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

            SHA512

            07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

          • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

            Filesize

            131KB

            MD5

            c4f79edc4498c5570495bb36fc942134

            SHA1

            00046b588252502480e8e708a22d25ae1d9b05fa

            SHA256

            b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

            SHA512

            07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

          • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe

            Filesize

            131KB

            MD5

            c4f79edc4498c5570495bb36fc942134

            SHA1

            00046b588252502480e8e708a22d25ae1d9b05fa

            SHA256

            b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

            SHA512

            07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

          • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe

            Filesize

            17KB

            MD5

            89dd6e72358a669b7d6e2348307a7af7

            SHA1

            0db348f3c6114a45d71f4d218e0e088b71c7bb0a

            SHA256

            ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

            SHA512

            93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

          • C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe

            Filesize

            17KB

            MD5

            89dd6e72358a669b7d6e2348307a7af7

            SHA1

            0db348f3c6114a45d71f4d218e0e088b71c7bb0a

            SHA256

            ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

            SHA512

            93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

          • memory/268-144-0x0000000020DA0000-0x0000000020DA5000-memory.dmp

            Filesize

            20KB

          • memory/268-143-0x0000000020D90000-0x0000000020D93000-memory.dmp

            Filesize

            12KB

          • memory/268-142-0x00000000016AA000-0x00000000016AF000-memory.dmp

            Filesize

            20KB

          • memory/268-139-0x0000000000000000-mapping.dmp

          • memory/2860-148-0x0000000000000000-mapping.dmp

          • memory/3484-145-0x0000000000000000-mapping.dmp

          • memory/3680-133-0x0000000021270000-0x0000000021275000-memory.dmp

            Filesize

            20KB

          • memory/3680-130-0x0000000000B6A000-0x0000000000B6F000-memory.dmp

            Filesize

            20KB

          • memory/3680-135-0x000000002126D000-0x0000000021276000-memory.dmp

            Filesize

            36KB

          • memory/3680-134-0x0000000021275000-0x000000002127A000-memory.dmp

            Filesize

            20KB

          • memory/3680-138-0x000000002126D000-0x0000000021279000-memory.dmp

            Filesize

            48KB

          • memory/3680-136-0x0000000021261000-0x000000002126C000-memory.dmp

            Filesize

            44KB

          • memory/3680-132-0x0000000021267000-0x000000002126A000-memory.dmp

            Filesize

            12KB

          • memory/3680-137-0x0000000021263000-0x000000002126C000-memory.dmp

            Filesize

            36KB

          • memory/3680-131-0x0000000021260000-0x0000000021263000-memory.dmp

            Filesize

            12KB

          • memory/4404-149-0x0000000000000000-mapping.dmp

          • memory/4404-151-0x000000000175A000-0x000000000175F000-memory.dmp

            Filesize

            20KB

          • memory/4404-152-0x0000000021C00000-0x0000000021C03000-memory.dmp

            Filesize

            12KB

          • memory/4404-153-0x0000000021C10000-0x0000000021C15000-memory.dmp

            Filesize

            20KB

          • memory/4404-154-0x0000000021C15000-0x0000000021C1A000-memory.dmp

            Filesize

            20KB