blacknet | 40b022c5ff2ecf2cfa11be4738839dbacafcfff233691256def7a1f2bdcd9060

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
12-11-2022 12:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0x000a0000000122f5-57.exe
Size

1.1MB
MD5

589cac94238870c8fdabc6262e5b3026
SHA1

d0c2fe2913f9a333b1402e42022f80b7d539b933
SHA256

40b022c5ff2ecf2cfa11be4738839dbacafcfff233691256def7a1f2bdcd9060
SHA512

d707e1b36599bd491d5ab29825969b3bfeb2fc1fc1f6fa906a0ad344eeddcef77565c55ad80bbe9a242139c217c0e08b3418ca79d1023bd494bc909e87ca0c57
SSDEEP

12288:gaJXLYjkwL4kIrgkRrVxkUcGkzkMMCwYoTtdYb9UtVyq/wEBHoCO9w9BJzWd8XUQ:gaJbMbL4wsxuGI08GZN8EOxJo

Score

10^/10

blacknet trojan

Malware Config

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet
Executes dropped EXE 1 IoCs

Processes:

svshost.exe

pid process

336 svshost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0x000a0000000122f5-57.exe

pid process

1696 0x000a0000000122f5-57.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0x000a0000000122f5-57.exe

description pid process

Token: SeDebugPrivilege 1696 0x000a0000000122f5-57.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0x000a0000000122f5-57.exe

pid process

1696 0x000a0000000122f5-57.exe
1696 0x000a0000000122f5-57.exe

pid	process
336	svshost.exe

pid	process
1696	0x000a0000000122f5-57.exe

description	pid	process
Token: SeDebugPrivilege	1696	0x000a0000000122f5-57.exe

pid	process
1696	0x000a0000000122f5-57.exe
1696	0x000a0000000122f5-57.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

0x000a0000000122f5-57.exe

description	pid	process	target process
PID 1696 wrote to memory of 336	1696	0x000a0000000122f5-57.exe	svshost.exe
PID 1696 wrote to memory of 336	1696	0x000a0000000122f5-57.exe	svshost.exe
PID 1696 wrote to memory of 336	1696	0x000a0000000122f5-57.exe	svshost.exe
PID 1696 wrote to memory of 336	1696	0x000a0000000122f5-57.exe	svshost.exe

C:\Users\Admin\AppData\Local\Temp\0x000a0000000122f5-57.exe
"C:\Users\Admin\AppData\Local\Temp\0x000a0000000122f5-57.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\svshost.exe
"C:\Users\Admin\AppData\Local\Temp\svshost.exe"
2⤵
- Executes dropped EXE
PID:336

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\svshost.exe
Filesize
381KB

MD5
0a499943ccd563c8b7d4bb3c7717a341

SHA1
c08a548c9d68f66feff1ce0bdc2e7ebddd1d5467

SHA256
d8ff47a7e4fc832c9dcafca95990fe8e989aeef493be5dfecca10d9c3228c64b

SHA512
89b0d83d2ea4b1e739c4f8d183670d8684624fb32ee29b22625adddb82a0b1a29c92423906bf3d4461d2efb3b46b717cb5cd742a29ed6b0d89d8735d5deb58f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\svshost.exe
Filesize
381KB

MD5
0a499943ccd563c8b7d4bb3c7717a341

SHA1
c08a548c9d68f66feff1ce0bdc2e7ebddd1d5467

SHA256
d8ff47a7e4fc832c9dcafca95990fe8e989aeef493be5dfecca10d9c3228c64b

SHA512
89b0d83d2ea4b1e739c4f8d183670d8684624fb32ee29b22625adddb82a0b1a29c92423906bf3d4461d2efb3b46b717cb5cd742a29ed6b0d89d8735d5deb58f9

Download Submit
memory/336-58-0x0000000000000000-mapping.dmp

Download
memory/336-61-0x0000000000B40000-0x0000000000BA4000-memory.dmp

Filesize
400KB

Download
memory/336-62-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/336-63-0x0000000004C05000-0x0000000004C16000-memory.dmp

Filesize
68KB

Download
memory/1696-54-0x000007FEF4930000-0x000007FEF5353000-memory.dmp

Filesize
10.1MB

Download
memory/1696-55-0x000007FEEE160000-0x000007FEEF1F6000-memory.dmp

Filesize
16.6MB

Download
memory/1696-56-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download
memory/1696-57-0x00000000003C6000-0x00000000003E5000-memory.dmp

Filesize
124KB

Download
memory/1696-64-0x00000000003C6000-0x00000000003E5000-memory.dmp

Filesize
124KB

Download