Analysis
- max time kernel
45s - max time network
158s - platform
windows7_x64 - resource
win7-20220414-en - submitted
04/05/2022, 01:41
General
- Target b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
- Size 131KB
- Sample220504-b4degaffck
- SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
Malware Config
Extracted
-
blacknet
-
v3.5 Public
-
HacKed
-
http://finalb.xyz/NiggaNet
-
BN[RqfcWolJ-7232457]
-
antivm
true
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
df7427b5e05183e625345c3c37ef31c0
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 2 IoCs
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsUpdate.exe
WindowsUpdate.exe
svchosts.exe
svchosts.exe
memory/480-141-0x000007FEF4B10000-0x000007FEF5533000-memory.dmp
memory/480-142-0x000007FEF3570000-0x000007FEF4606000-memory.dmp
memory/892-72-0x000000001F831000-0x000000001F841000-memory.dmp
memory/892-76-0x000000001F851000-0x000000001F861000-memory.dmp
memory/892-61-0x000000001F800000-0x000000001F809000-memory.dmp
memory/892-62-0x00000000005A9000-0x00000000005AD000-memory.dmp
memory/892-63-0x00000000005AD000-0x00000000005B1000-memory.dmp
memory/892-64-0x00000000005B1000-0x00000000005B5000-memory.dmp
memory/892-65-0x00000000005B5000-0x00000000005B9000-memory.dmp
memory/892-67-0x00000000005BD000-0x00000000005C5000-memory.dmp
memory/892-66-0x00000000005B9000-0x00000000005BD000-memory.dmp
memory/892-68-0x000000001F809000-0x000000001F811000-memory.dmp
memory/892-69-0x000000001F811000-0x000000001F819000-memory.dmp
memory/892-70-0x000000001F819000-0x000000001F821000-memory.dmp
memory/892-71-0x000000001F829000-0x000000001F831000-memory.dmp
memory/892-59-0x00000000005A1000-0x00000000005A5000-memory.dmp
memory/892-73-0x000000001F821000-0x000000001F829000-memory.dmp
memory/892-74-0x00000000005C5000-0x00000000005D0000-memory.dmp
memory/892-75-0x000000001F841000-0x000000001F851000-memory.dmp
memory/892-60-0x00000000005A5000-0x00000000005A9000-memory.dmp
memory/892-78-0x000000001F871000-0x000000001F881000-memory.dmp
memory/892-79-0x000000001F881000-0x000000001F891000-memory.dmp
memory/892-77-0x000000001F861000-0x000000001F871000-memory.dmp
memory/892-80-0x000000001F891000-0x000000001F8A1000-memory.dmp
memory/892-81-0x000000001F8A1000-0x000000001F8B1000-memory.dmp
memory/892-82-0x000000001F8B1000-0x000000001F8D1000-memory.dmp
memory/892-88-0x000000001F8D1000-0x000000001F8F1000-memory.dmp
memory/892-89-0x0000000020500000-0x0000000020521000-memory.dmp
memory/892-90-0x0000000020521000-0x0000000020541000-memory.dmp
memory/892-58-0x000000000059D000-0x00000000005A1000-memory.dmp
memory/892-91-0x0000000020541000-0x0000000020561000-memory.dmp
memory/892-93-0x0000000020561000-0x0000000020581000-memory.dmp
memory/892-57-0x0000000000556000-0x0000000000575000-memory.dmp
memory/892-56-0x000007FEFC4D1000-0x000007FEFC4D3000-memory.dmp
memory/892-55-0x000007FEF3570000-0x000007FEF4606000-memory.dmp
memory/892-54-0x000007FEF4B10000-0x000007FEF5533000-memory.dmp
memory/1740-87-0x000007FEF3570000-0x000007FEF4606000-memory.dmp
memory/1740-98-0x0000000000C65000-0x0000000000C69000-memory.dmp
memory/1740-100-0x0000000000C49000-0x0000000000C4F000-memory.dmp
memory/1740-101-0x0000000000C69000-0x0000000000C6C000-memory.dmp
memory/1740-99-0x0000000000C61000-0x0000000000C64000-memory.dmp
memory/1740-97-0x0000000000C61000-0x0000000000C65000-memory.dmp
memory/1740-102-0x0000000000C3E000-0x0000000000C46000-memory.dmp
memory/1740-103-0x0000000000C6D000-0x0000000000C71000-memory.dmp
memory/1740-105-0x0000000000C75000-0x0000000000C79000-memory.dmp
memory/1740-104-0x0000000000C71000-0x0000000000C75000-memory.dmp
memory/1740-106-0x0000000000C79000-0x0000000000C7D000-memory.dmp
memory/1740-108-0x000000001CD99000-0x000000001CDA9000-memory.dmp
memory/1740-114-0x000000001CD69000-0x000000001CD71000-memory.dmp
memory/1740-113-0x000000001CD61000-0x000000001CD69000-memory.dmp
memory/1740-112-0x000000001CD59000-0x000000001CD61000-memory.dmp
memory/1740-116-0x000000001CDA9000-0x000000001CDB9000-memory.dmp
memory/1740-117-0x000000001CD79000-0x000000001CD81000-memory.dmp
memory/1740-119-0x000000001CDB9000-0x000000001CDC9000-memory.dmp
memory/1740-118-0x000000001CD81000-0x000000001CD89000-memory.dmp
memory/1740-115-0x000000001CD71000-0x000000001CD79000-memory.dmp
memory/1740-111-0x000000001CD50000-0x000000001CD59000-memory.dmp
memory/1740-110-0x0000000000C81000-0x0000000000C89000-memory.dmp
memory/1740-109-0x0000000000C7D000-0x0000000000C81000-memory.dmp
memory/1740-107-0x000000001CD89000-0x000000001CD99000-memory.dmp
memory/1740-120-0x000000001CDC9000-0x000000001CDD9000-memory.dmp
memory/1740-121-0x000000001E1B1000-0x000000001E1D1000-memory.dmp
memory/1740-123-0x000000001E1D1000-0x000000001E1F1000-memory.dmp
memory/1740-122-0x000000001CDD9000-0x000000001CDE9000-memory.dmp
memory/1740-124-0x000000001CDE9000-0x000000001CDF9000-memory.dmp
memory/1740-125-0x000000001E1F1000-0x000000001E211000-memory.dmp
memory/1740-126-0x000000001CDF9000-0x000000001CE09000-memory.dmp
memory/1740-96-0x0000000000C51000-0x0000000000C58000-memory.dmp
memory/1740-95-0x0000000000C5D000-0x0000000000C61000-memory.dmp
memory/1740-94-0x0000000000C16000-0x0000000000C35000-memory.dmp
memory/1740-86-0x000007FEF4B10000-0x000007FEF5533000-memory.dmp