blacknet | 6f02ca9fdc2cd216c60c1013dc5bfbca6384ed866e39b033a3c2bf68cdc0b79e

Analysis

max time kernel
106s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2022, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe
Size 438KB
Sample220814-grnmkaafdn
SHA256 6f02ca9fdc2cd216c60c1013dc5bfbca6384ed866e39b033a3c2bf68cdc0b79e
MD5 0c551697d82616d3b1a485eddf0af56f
SHA1 40023cac06e70e14c13fbc7b710e87fce5406c61
SHA512 63a260836f4de87333232c899c8d5351a9db1e338caffbf2f5f577f96bbadac992bc041a623f7b3c1cbfea5af5228060b95725f758b1abf6428e75c17684a9a8
MD5 SHA1 SHA512

Score

10^/10

blacknet trojan

Malware Config

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

Executes dropped EXE 1 IoCs

pid	Process
1708	update.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe
1708	update.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	update.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1708	update.exe
1708	update.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 1708	4244	6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe	78
PID 4244 wrote to memory of 1708	4244	6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe	78
PID 4244 wrote to memory of 4020	4244	6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe	80
PID 4244 wrote to memory of 4020	4244	6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe	80
PID 4244 wrote to memory of 4020	4244	6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe	80

C:\Users\Admin\AppData\Local\Temp\6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe
"C:\Users\Admin\AppData\Local\Temp\6F02CA9FDC2CD216C60C1013DC5BFBCA6384ED866E39B.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Roaming\update.exe
  "C:\Users\Admin\AppData\Roaming\update.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Discord-Nitro-Generator.bat" "
  2⤵
  PID:4020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Discord-Nitro-Generator.bat

Path C:\Users\Admin\AppData\Roaming\Discord-Nitro-Generator.bat
Size 3KB
SHA256 a5a0d5e79c1f88b6ad650ddfa522f0ace1239cb20d5ee8c077d0dbfd1195914e
MD5 7bc715359db2720d52250539a3000774
SHA1 347cff5768cf149573e5db50889f823dda624712
SHA512 7844b08d6335d7eca718a02998c6a556e4063acd059725a746b805cf42f4c3677e8c9204dbcb5c657e9822a3b7c6049f2fef2dd6b9e73e412bfe0c56673f133f
MD5 SHA1 SHA512

Submit Download

update.exe

Path C:\Users\Admin\AppData\Roaming\update.exe
Size 308KB
SHA256 530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
MD5 ea3b5c344a9a8c382513bf20bd073870
SHA1 b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA512 dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
SSDEEP 6144:PmdL2Zy8byrR64DYDUOj9YvGmKI8vkD8REDwWqeNGq+eLmbXNs0JpwJ+XSBH+Qi:PUL2I8bOWDUaYvGmKICkD8REDwWqeNGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

update.exe

Path C:\Users\Admin\AppData\Roaming\update.exe
Size 308KB
SHA256 530abe6bbab9935fc5de06e44f8441421118a27a1a4fe9b29866594c6292e273
MD5 ea3b5c344a9a8c382513bf20bd073870
SHA1 b11a7f4ffa68e519760ed1f36e0fffd409a70d87
SHA512 dfd2cce94257eecfc7b6e1268c8f64da602037338bb69f733dc92dca3f94030133357511d5a7c095a10030584475cfdc214d7859b2d7d5b0d67ee6ae288a4484
SSDEEP 6144:PmdL2Zy8byrR64DYDUOj9YvGmKI8vkD8REDwWqeNGq+eLmbXNs0JpwJ+XSBH+Qi:PUL2I8bOWDUaYvGmKICkD8REDwWqeNGD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1708-137-0x00007FFE7F8A0000-0x00007FFE802D6000-memory.dmp

Download

memory/1708-138-0x00000000014FA000-0x00000000014FF000-memory.dmp

Download

memory/1708-139-0x00000000014FA000-0x00000000014FF000-memory.dmp

Download