blacknet | 753af27307876aa774a1f942184312dd73fa8f85331a5bc8c0f35dede2a5702a

General

Target

Client.exe
Size

81KB
MD5

d504f7de6fc5459ee783b868766c1c4b
SHA1

f31c98177ddfed34d1aa4bbb15b4dd22a887bf7a
SHA256

753af27307876aa774a1f942184312dd73fa8f85331a5bc8c0f35dede2a5702a
SHA512

9c42c754c70d4b82f120d380faf615e8ff118668ffd56e5fdc0218224be1a22c91f402f656fe625092f6d6070131b2e9c399e8e430eac2a944376459ef62786e
SSDEEP

1536:JZuhD5z28TCRZyDeK0uKsA1HdCbv42jYLe81d:5OeKKJwbvTj6eud

Score

10^/10

blacknet bot persistence trojan

Malware Config

Extracted

Family

blacknet

Version

v3.5 Public

Botnet

bot

C2

http://52.34.77.168:54948

Mutex

BN[mIgYVgxM-7572066]

Attributes

antivm
false
elevate_uac
false
install_name
svchost.exe
splitter
|BN|
start_name
14247ae8e9bdf8a07859c46cc6c701e5
startup
true
usb_spread
true

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe	family_blacknet
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe	family_blacknet

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe	disable_win_def
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe	disable_win_def

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1820 svchost.exe

pid	process
1820	svchost.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Client.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\14247ae8e9bdf8a07859c46cc6c701e5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\14247ae8e9bdf8a07859c46cc6c701e5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\svchost.exe"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\14247ae8e9bdf8a07859c46cc6c701e5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Client.exesvchost.exe

pid process

1768 Client.exe
1820 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Client.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1768 Client.exe
Token: SeDebugPrivilege 1820 svchost.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Client.exesvchost.exe

pid process

1768 Client.exe
1768 Client.exe
1820 svchost.exe
1820 svchost.exe

pid	process
1768	Client.exe
1820	svchost.exe

description	pid	process
Token: SeDebugPrivilege	1768	Client.exe
Token: SeDebugPrivilege	1820	svchost.exe

pid	process
1768	Client.exe
1768	Client.exe
1820	svchost.exe
1820	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

Client.exe

description	pid	process	target process
PID 1768 wrote to memory of 1820	1768	Client.exe	svchost.exe
PID 1768 wrote to memory of 1820	1768	Client.exe	svchost.exe
PID 1768 wrote to memory of 1820	1768	Client.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe
Filesize
81KB

MD5
d504f7de6fc5459ee783b868766c1c4b

SHA1
f31c98177ddfed34d1aa4bbb15b4dd22a887bf7a

SHA256
753af27307876aa774a1f942184312dd73fa8f85331a5bc8c0f35dede2a5702a

SHA512
9c42c754c70d4b82f120d380faf615e8ff118668ffd56e5fdc0218224be1a22c91f402f656fe625092f6d6070131b2e9c399e8e430eac2a944376459ef62786e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe
Filesize
81KB

MD5
d504f7de6fc5459ee783b868766c1c4b

SHA1
f31c98177ddfed34d1aa4bbb15b4dd22a887bf7a

SHA256
753af27307876aa774a1f942184312dd73fa8f85331a5bc8c0f35dede2a5702a

SHA512
9c42c754c70d4b82f120d380faf615e8ff118668ffd56e5fdc0218224be1a22c91f402f656fe625092f6d6070131b2e9c399e8e430eac2a944376459ef62786e

Download Submit
memory/1768-54-0x000007FEF49A0000-0x000007FEF53C3000-memory.dmp

Filesize
10.1MB

Download
memory/1768-55-0x000007FEF36C0000-0x000007FEF4756000-memory.dmp

Filesize
16.6MB

Download
memory/1768-56-0x000007FEFC591000-0x000007FEFC593000-memory.dmp

Filesize
8KB

Download
memory/1768-57-0x0000000000A36000-0x0000000000A55000-memory.dmp

Filesize
124KB

Download
memory/1768-58-0x0000000000A36000-0x0000000000A55000-memory.dmp

Filesize
124KB

Download
memory/1768-64-0x0000000000A36000-0x0000000000A55000-memory.dmp

Filesize
124KB

Download
memory/1820-59-0x0000000000000000-mapping.dmp

Download
memory/1820-62-0x000007FEF49A0000-0x000007FEF53C3000-memory.dmp

Filesize
10.1MB

Download
memory/1820-63-0x000007FEF36C0000-0x000007FEF4756000-memory.dmp

Filesize
16.6MB

Download
memory/1820-66-0x0000000001F36000-0x0000000001F55000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads