Extracted

Extracted

• • Target

    1732-89-0x0000000010560000-0x00000000105B1000-memory.dmp

  • Size

    324KB

  • MD5

    502f23821a675b1eeef88072cd7539e9

  • SHA1

    2b48a14d21a1184444f583234b7dbd5aa9f525b1

  • SHA256

    6be7c3ecbf8b4f6f80324c4238e6f78fd42a44087a5232f6e0f0a058b9cfa8cf

  • SHA512

    2d641a94b0295051ee96bac581d48c920296ba66afcdda33fd043b7fc5c89dbcef39bdcd017f7271837c799f06b3ead7a87cd1959051b680c3c7e2ddf5200373

  • SSDEEP

    6144:ucCmiQfipBKWzkeHrb08rTj6aBpSYdS1wjzcoeqqD95Ix:ucXiQfipPrb08rTj6+pGWqYx

  Score

  10^/10

  blacknetdarkcometnetwirebotguest16botnetevasionpersistenceratstealertrojanupx

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet

  • BlackNET payload

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Modifies WinLogon for persistence

    persistence

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Stops running service(s)

    evasion

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1