General
-
Target
https://cdn.discordapp.com/attachments/1027195292883370034/1030887480645386361/WindowsProtect.exe
-
Sample
221024-ppjvlagea9
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.discordapp.com/attachments/1027195292883370034/1030887480645386361/WindowsProtect.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
https://cdn.discordapp.com/attachments/1027195292883370034/1030887480645386361/WindowsProtect.exe
Resource
win10v2004-20220901-en
Malware Config
Extracted
blacknet
v3.7.0 Public
HacKed
http://zenginler.online/blacknet
BN[8e74b7adc9cdf87b]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
false
Targets
-
-
Target
https://cdn.discordapp.com/attachments/1027195292883370034/1030887480645386361/WindowsProtect.exe
Score10/10-
BlackNET payload
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-