blacknet | bf0dae2bf317f6fd26f8815792aa685671842fa9393cef61c394b37ff552595d

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
30/12/2022, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe
Size 206KB
Sample221230-srbhsaba91
SHA256 bf0dae2bf317f6fd26f8815792aa685671842fa9393cef61c394b37ff552595d
MD5 3917f35aed62a03adffbe0f22ff0d446
SHA1 7e2b3ffff8220e0b2b603e97343bfafcc7ea1079
SHA512 3918e1f4b67f0195cff25a1326431ddf04ee173b50553e6ee4a0072879402388e16c5fcd6d9f2e6117e3b09b90496808776ba1fed5b92c6e69ab808949081911
SSDEEP 3072:OxkNWNo7HCdkVTYB+eztx3be/EKyNFna4FwX5F:sePHd5YB+eztlboZ8wX5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

blacknet prueba trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

PRUEBA

http://74.208.16.112/net

Mutex

BN[]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

resource	yara_rule
behavioral1/memory/2044-54-0x00000000000C0000-0x00000000000F8000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2044-54-0x00000000000C0000-0x00000000000F8000-memory.dmp	disable_win_def

Deletes itself 1 IoCs

pid	Process
336	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1704	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
808	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe
2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 604	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	29
PID 2044 wrote to memory of 604	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	29
PID 2044 wrote to memory of 604	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	29
PID 2044 wrote to memory of 336	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	31
PID 2044 wrote to memory of 336	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	31
PID 2044 wrote to memory of 336	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	31
PID 2044 wrote to memory of 1704	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	33
PID 2044 wrote to memory of 1704	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	33
PID 2044 wrote to memory of 1704	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	33
PID 336 wrote to memory of 808	336	cmd.exe	35
PID 336 wrote to memory of 808	336	cmd.exe	35
PID 336 wrote to memory of 808	336	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\schtasks.exe
  "schtasks" /delete /tn "WindowsUpdate.exe" /f
  2⤵
  PID:604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 1.1.1.1 -n 5 -w 5000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 5 -w 5000
    3⤵
    - Runs ping.exe
    PID:808
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x00000000000C0000-0x00000000000F8000-memory.dmp

Download

memory/2044-55-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Download

memory/2044-56-0x000000001B1A9000-0x000000001B1C8000-memory.dmp

Download

memory/2044-61-0x000000001B1A9000-0x000000001B1C8000-memory.dmp

Download