General
-
Target
WinlockerBuilderv5.exe
-
Size
11.0MB
-
Sample
220520-1f7qvahafr
-
MD5
5891817266ffedc10d4a84a3bd483239
-
SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
-
SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
-
SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
Behavioral task
behavioral1
Sample
WinlockerBuilderv5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
WinlockerBuilderv5.exe
Resource
win10-20220414-en
Behavioral task
behavioral3
Sample
WinlockerBuilderv5.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral4
Sample
WinlockerBuilderv5.exe
Resource
win11-20220223-en
Malware Config
Extracted
blacknet
v3.6.0 Public
Bot
http://f0483357.xsph.ru/
BN[PHfunXGI-6235724]
-
antivm
true
-
elevate_uac
false
-
install_name
jusched.exe
-
splitter
|BN|
-
start_name
a5b002eacf54590ec8401ff6d3f920ee
-
startup
true
-
usb_spread
true
Targets
-
-
Target
WinlockerBuilderv5.exe
-
Size
11.0MB
-
MD5
5891817266ffedc10d4a84a3bd483239
-
SHA1
b59d365a91b50ec55ccc1c1b2a70cbf858382aa3
-
SHA256
51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
-
SHA512
517c5d785f069ce566c1d89fcc998968a5cdfc6d85bcc7e42cc2e720b4be9b543065cc1c7967635948595fdbb4af3fc7714c8b90aa6035953bca40cba7272c23
-
BlackNET Payload
-
Modifies WinLogon for persistence
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-