blacknet | b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

Analysis

max time kernel
58s
max time network
194s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-05-2022 08:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
Size

131KB
MD5

c4f79edc4498c5570495bb36fc942134
SHA1

00046b588252502480e8e708a22d25ae1d9b05fa
SHA256

b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09
SHA512

07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

Score

10^/10

blacknet hacked persistence trojan

Malware Config

Extracted

Family

blacknet

Version

v3.5 Public

Botnet

HacKed

http://finalb.xyz/NiggaNet

Mutex

BN[RqfcWolJ-7232457]

Attributes

antivm
true
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
df7427b5e05183e625345c3c37ef31c0
startup
true
usb_spread
true

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET Payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe	family_blacknet
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe	family_blacknet

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe	disable_win_def
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe	disable_win_def

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\df7427b5e05183e625345c3c37ef31c0 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

pid	process
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

description pid process

Token: SeDebugPrivilege 1344 b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

description	pid	process
Token: SeDebugPrivilege	1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

pid	process
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
1344	b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe

C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe
"C:\Users\Admin\AppData\Local\Temp\b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1344

C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe"
2⤵
PID:1928

C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe"
3⤵
PID:948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
Filesize
131KB

MD5
c4f79edc4498c5570495bb36fc942134

SHA1
00046b588252502480e8e708a22d25ae1d9b05fa

SHA256
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

SHA512
07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\WindowsUpdate.exe
Filesize
131KB

MD5
c4f79edc4498c5570495bb36fc942134

SHA1
00046b588252502480e8e708a22d25ae1d9b05fa

SHA256
b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09

SHA512
07bdeb39b35835a752886c2d308a68d263b36e8372d2bf320ede5b85252d14e284985d0889dfa9fcffec7ede7c3585a46cb0165b00be903755ffe63cacb21cef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe
Filesize
17KB

MD5
89dd6e72358a669b7d6e2348307a7af7

SHA1
0db348f3c6114a45d71f4d218e0e088b71c7bb0a

SHA256
ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

SHA512
93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\MyClient\svchosts.exe
Filesize
17KB

MD5
89dd6e72358a669b7d6e2348307a7af7

SHA1
0db348f3c6114a45d71f4d218e0e088b71c7bb0a

SHA256
ad34794058212006ae974fcc6a0242598e6d020f08044439e3512773cd402b7e

SHA512
93b8a47686d7491281a0809b138a6244a535302ba0d6b2146849e9888632c72b6223ae8eb7a24f1006aaf57ab947a8f43719cff4837df559e7bf42f52c63856b

Download Submit
memory/948-130-0x0000000000000000-mapping.dmp

Download
memory/948-133-0x000007FEF2DE0000-0x000007FEF3E76000-memory.dmp

Filesize
16.6MB

Download
memory/1344-66-0x0000000002157000-0x0000000002160000-memory.dmp

Filesize
36KB

Download
memory/1344-69-0x000000000210C000-0x0000000002110000-memory.dmp

Filesize
16KB

Download
memory/1344-62-0x0000000002124000-0x0000000002128000-memory.dmp

Filesize
16KB

Download
memory/1344-63-0x0000000002137000-0x000000000213B000-memory.dmp

Filesize
16KB

Download
memory/1344-64-0x000000000213B000-0x000000000213F000-memory.dmp

Filesize
16KB

Download
memory/1344-65-0x0000000002147000-0x000000000214B000-memory.dmp

Filesize
16KB

Download
memory/1344-54-0x000007FEF2DE0000-0x000007FEF3E76000-memory.dmp

Filesize
16.6MB

Download
memory/1344-67-0x000000001F649000-0x000000001F651000-memory.dmp

Filesize
32KB

Download
memory/1344-68-0x000000000214B000-0x000000000214F000-memory.dmp

Filesize
16KB

Download
memory/1344-61-0x0000000002121000-0x0000000002128000-memory.dmp

Filesize
28KB

Download
memory/1344-70-0x0000000002113000-0x000000000211A000-memory.dmp

Filesize
28KB

Download
memory/1344-71-0x000000000214F000-0x0000000002157000-memory.dmp

Filesize
32KB

Download
memory/1344-72-0x000000001F640000-0x000000001F649000-memory.dmp

Filesize
36KB

Download
memory/1344-60-0x000000000211C000-0x000000000211F000-memory.dmp

Filesize
12KB

Download
memory/1344-59-0x0000000002131000-0x0000000002135000-memory.dmp

Filesize
16KB

Download
memory/1344-58-0x000000000210D000-0x0000000002119000-memory.dmp

Filesize
48KB

Download
memory/1344-57-0x000000000212D000-0x0000000002131000-memory.dmp

Filesize
16KB

Download
memory/1344-56-0x00000000020E6000-0x0000000002105000-memory.dmp

Filesize
124KB

Download
memory/1344-55-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download
memory/1928-99-0x0000000000B4D000-0x0000000000B50000-memory.dmp

Filesize
12KB

Download
memory/1928-109-0x000000001CDB9000-0x000000001CDC1000-memory.dmp

Filesize
32KB

Download
memory/1928-82-0x0000000000B55000-0x0000000000B59000-memory.dmp

Filesize
16KB

Download
memory/1928-81-0x0000000000B51000-0x0000000000B55000-memory.dmp

Filesize
16KB

Download
memory/1928-80-0x0000000000B2C000-0x0000000000B36000-memory.dmp

Filesize
40KB

Download
memory/1928-79-0x0000000000B4D000-0x0000000000B51000-memory.dmp

Filesize
16KB

Download
memory/1928-86-0x0000000000B3A000-0x0000000000B3F000-memory.dmp

Filesize
20KB

Download
memory/1928-88-0x0000000000B62000-0x0000000000B66000-memory.dmp

Filesize
16KB

Download
memory/1928-89-0x0000000000B32000-0x0000000000B36000-memory.dmp

Filesize
16KB

Download
memory/1928-87-0x0000000000B5E000-0x0000000000B62000-memory.dmp

Filesize
16KB

Download
memory/1928-100-0x0000000000B6A000-0x0000000000B6D000-memory.dmp

Filesize
12KB

Download
memory/1928-84-0x0000000000B41000-0x0000000000B44000-memory.dmp

Filesize
12KB

Download
memory/1928-98-0x000000001CD91000-0x000000001CD99000-memory.dmp

Filesize
32KB

Download
memory/1928-97-0x000000001CD89000-0x000000001CD91000-memory.dmp

Filesize
32KB

Download
memory/1928-101-0x0000000000B45000-0x0000000000B4A000-memory.dmp

Filesize
20KB

Download
memory/1928-96-0x000000001CD80000-0x000000001CD89000-memory.dmp

Filesize
36KB

Download
memory/1928-95-0x0000000000B72000-0x0000000000B7A000-memory.dmp

Filesize
32KB

Download
memory/1928-94-0x0000000000B6E000-0x0000000000B72000-memory.dmp

Filesize
16KB

Download
memory/1928-93-0x0000000000B6A000-0x0000000000B6E000-memory.dmp

Filesize
16KB

Download
memory/1928-92-0x0000000000B5E000-0x0000000000B65000-memory.dmp

Filesize
28KB

Download
memory/1928-91-0x0000000000B54000-0x0000000000B58000-memory.dmp

Filesize
16KB

Download
memory/1928-90-0x0000000000B66000-0x0000000000B6A000-memory.dmp

Filesize
16KB

Download
memory/1928-102-0x000000001CD99000-0x000000001CDA1000-memory.dmp

Filesize
32KB

Download
memory/1928-105-0x000000001CDA9000-0x000000001CDB1000-memory.dmp

Filesize
32KB

Download
memory/1928-104-0x000000001CDD1000-0x000000001CDE1000-memory.dmp

Filesize
64KB

Download
memory/1928-83-0x0000000000B59000-0x0000000000B5D000-memory.dmp

Filesize
16KB

Download
memory/1928-108-0x000000001CDB1000-0x000000001CDB9000-memory.dmp

Filesize
32KB

Download
memory/1928-111-0x000000001CDC1000-0x000000001CDD1000-memory.dmp

Filesize
64KB

Download
memory/1928-110-0x000000001CE01000-0x000000001CE11000-memory.dmp

Filesize
64KB

Download
memory/1928-107-0x000000001CDF1000-0x000000001CE01000-memory.dmp

Filesize
64KB

Download
memory/1928-106-0x000000001CDE1000-0x000000001CDF1000-memory.dmp

Filesize
64KB

Download
memory/1928-103-0x000000001CDA1000-0x000000001CDA9000-memory.dmp

Filesize
32KB

Download
memory/1928-117-0x000000001E121000-0x000000001E141000-memory.dmp

Filesize
128KB

Download
memory/1928-116-0x000000001E100000-0x000000001E121000-memory.dmp

Filesize
132KB

Download
memory/1928-115-0x000000001CE41000-0x000000001CE61000-memory.dmp

Filesize
128KB

Download
memory/1928-118-0x000000001E141000-0x000000001E161000-memory.dmp

Filesize
128KB

Download
memory/1928-114-0x000000001CE31000-0x000000001CE41000-memory.dmp

Filesize
64KB

Download
memory/1928-113-0x000000001CE21000-0x000000001CE31000-memory.dmp

Filesize
64KB

Download
memory/1928-112-0x000000001CE11000-0x000000001CE21000-memory.dmp

Filesize
64KB

Download
memory/1928-119-0x000000001E161000-0x000000001E181000-memory.dmp

Filesize
128KB

Download
memory/1928-120-0x000000001E181000-0x000000001E1A1000-memory.dmp

Filesize
128KB

Download
memory/1928-123-0x0000000000B66000-0x0000000000B6B000-memory.dmp

Filesize
20KB

Download
memory/1928-124-0x0000000000B6E000-0x0000000000B79000-memory.dmp

Filesize
44KB

Download
memory/1928-122-0x0000000000B46000-0x0000000000B4A000-memory.dmp

Filesize
16KB

Download
memory/1928-121-0x0000000000B5E000-0x0000000000B61000-memory.dmp

Filesize
12KB

Download
memory/1928-85-0x0000000000B51000-0x0000000000B54000-memory.dmp

Filesize
12KB

Download
memory/1928-78-0x0000000000B06000-0x0000000000B25000-memory.dmp

Filesize
124KB

Download
memory/1928-76-0x000007FEF2DE0000-0x000007FEF3E76000-memory.dmp

Filesize
16.6MB

Download
memory/1928-73-0x0000000000000000-mapping.dmp

Download