Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
12/11/2022, 12:36
General
-
Target
0x000a0000000122f5-57.exe
-
Size
1.1MB
-
MD5
589cac94238870c8fdabc6262e5b3026
-
SHA1
d0c2fe2913f9a333b1402e42022f80b7d539b933
-
SHA256
40b022c5ff2ecf2cfa11be4738839dbacafcfff233691256def7a1f2bdcd9060
-
SHA512
d707e1b36599bd491d5ab29825969b3bfeb2fc1fc1f6fa906a0ad344eeddcef77565c55ad80bbe9a242139c217c0e08b3418ca79d1023bd494bc909e87ca0c57
-
SSDEEP
12288:gaJXLYjkwL4kIrgkRrVxkUcGkzkMMCwYoTtdYb9UtVyq/wEBHoCO9w9BJzWd8XUQ:gaJbMbL4wsxuGI08GZN8EOxJo
Malware Config
Signatures
-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000a0000000122f5-57.exe"C:\Users\Admin\AppData\Local\Temp\0x000a0000000122f5-57.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svshost.exe"C:\Users\Admin\AppData\Local\Temp\svshost.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD50a499943ccd563c8b7d4bb3c7717a341
SHA1c08a548c9d68f66feff1ce0bdc2e7ebddd1d5467
SHA256d8ff47a7e4fc832c9dcafca95990fe8e989aeef493be5dfecca10d9c3228c64b
SHA51289b0d83d2ea4b1e739c4f8d183670d8684624fb32ee29b22625adddb82a0b1a29c92423906bf3d4461d2efb3b46b717cb5cd742a29ed6b0d89d8735d5deb58f9
-
Filesize
381KB
MD50a499943ccd563c8b7d4bb3c7717a341
SHA1c08a548c9d68f66feff1ce0bdc2e7ebddd1d5467
SHA256d8ff47a7e4fc832c9dcafca95990fe8e989aeef493be5dfecca10d9c3228c64b
SHA51289b0d83d2ea4b1e739c4f8d183670d8684624fb32ee29b22625adddb82a0b1a29c92423906bf3d4461d2efb3b46b717cb5cd742a29ed6b0d89d8735d5deb58f9
-
Filesize
400KB
-
Filesize
624KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
344KB
-
Filesize
10.2MB
-
Filesize
20KB
-
Filesize
20KB