Overview

overview

10

Static

static

a1966fa00a...cc.exe

windows7_x64

1

a1966fa00a...cc.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    116s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 19:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a1966fa00ae577eca2476a7d89930a93ada31f36005e09c2091f6dad78615ccc.exe

  • Size

    456KB

  • MD5

    dac7eef8f750ba52bffba2bf369151bc

  • SHA1

    e0d777aec0d963bd77a892f440fd19a1d5760b52

  • SHA256

    a1966fa00ae577eca2476a7d89930a93ada31f36005e09c2091f6dad78615ccc

  • SHA512

    abd980075a13f2401ee7d39d6a5c18933cb825c7ab4897c3dea875d53c59ba06d76a6c3e54a67455315572b4f596fb454ff55ffbba40fd1258c220e733af24ac

Score
10/10
blacknetpersistencesuricatatrojan

Malware Config

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet
  • suricata: ET MALWARE Win32/BlackNET CnC Requesting Command

    suricata: ET MALWARE Win32/BlackNET CnC Requesting Command

    suricata
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1966fa00ae577eca2476a7d89930a93ada31f36005e09c2091f6dad78615ccc.exe
    "C:\Users\Admin\AppData\Local\Temp\a1966fa00ae577eca2476a7d89930a93ada31f36005e09c2091f6dad78615ccc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3044

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3044-130-0x00000000746B0000-0x0000000074C61000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3044-131-0x00000000010BA000-0x00000000010BF000-memory.dmp
    Filesize

    20KB

    Download
  • memory/3044-132-0x000000000B040000-0x000000000B043000-memory.dmp
    Filesize

    12KB

    Download
  • memory/3044-133-0x000000000B043000-0x000000000B046000-memory.dmp
    Filesize

    12KB

    Download
  • memory/3044-134-0x000000000B046000-0x000000000B049000-memory.dmp
    Filesize

    12KB

    Download