Analysis
- max time kernel
8s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
08/05/2022, 19:48
General
- Target b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
- Size 131KB
- Sample220508-yh35bsbegn
- SHA256 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
Malware Config
Extracted
-
blacknet
-
v3.5 Public
-
HacKed
-
http://finalb.xyz/NiggaNet
-
BN[RqfcWolJ-7232457]
-
antivm
true
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
df7427b5e05183e625345c3c37ef31c0
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET Payload 17 IoCs
- Contains code to disable Windows Defender 17 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe.log
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
svchosts.exe
svchosts.exe
WindowsUpdate.exe
WindowsUpdate.exe
memory/856-136-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/856-141-0x0000000000F5A000-0x0000000000F5F000-memory.dmp
memory/856-142-0x0000000021230000-0x0000000021233000-memory.dmp
memory/1272-202-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/1272-203-0x00000000012DA000-0x00000000012DF000-memory.dmp
memory/1432-162-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/1432-163-0x0000000000F7A000-0x0000000000F7F000-memory.dmp
memory/2640-170-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/2640-171-0x000000000166A000-0x000000000166F000-memory.dmp
memory/2776-140-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/3084-147-0x0000000000BDA000-0x0000000000BDF000-memory.dmp
memory/3084-146-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/3152-166-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/3152-167-0x000000000151A000-0x000000000151F000-memory.dmp
memory/3168-174-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/3168-175-0x0000000000BDA000-0x0000000000BDF000-memory.dmp
memory/3384-183-0x000000000081A000-0x000000000081F000-memory.dmp
memory/3384-150-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/3384-182-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/3384-151-0x000000000098A000-0x000000000098F000-memory.dmp
memory/3644-190-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/3644-191-0x000000000152A000-0x000000000152F000-memory.dmp
memory/4184-158-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/4184-159-0x0000000000C40000-0x0000000000C50000-memory.dmp
memory/4248-186-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/4248-187-0x00000000011AA000-0x00000000011AF000-memory.dmp
memory/4360-132-0x0000000021CE0000-0x0000000021CE3000-memory.dmp
memory/4360-130-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/4360-131-0x00000000012FA000-0x00000000012FF000-memory.dmp
memory/4716-155-0x00000000010FA000-0x00000000010FF000-memory.dmp
memory/4716-154-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/4728-198-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/4728-199-0x0000000000CAA000-0x0000000000CAF000-memory.dmp
memory/4820-179-0x0000000000E2A000-0x0000000000E2F000-memory.dmp
memory/4820-178-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/5104-194-0x00007FFD61080000-0x00007FFD61AB6000-memory.dmp
memory/5104-195-0x000000000089A000-0x000000000089F000-memory.dmp