blacknet | bf0dae2bf317f6fd26f8815792aa685671842fa9393cef61c394b37ff552595d

General

Target

HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe
Size

206KB
MD5

3917f35aed62a03adffbe0f22ff0d446
SHA1

7e2b3ffff8220e0b2b603e97343bfafcc7ea1079
SHA256

bf0dae2bf317f6fd26f8815792aa685671842fa9393cef61c394b37ff552595d
SHA512

3918e1f4b67f0195cff25a1326431ddf04ee173b50553e6ee4a0072879402388e16c5fcd6d9f2e6117e3b09b90496808776ba1fed5b92c6e69ab808949081911
SSDEEP

3072:OxkNWNo7HCdkVTYB+eztx3be/EKyNFna4FwX5F:sePHd5YB+eztlboZ8wX5

Score

10^/10

blacknet prueba trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

PRUEBA

C2

http://74.208.16.112/net

Mutex

BN[]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2044-54-0x00000000000C0000-0x00000000000F8000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2044-54-0x00000000000C0000-0x00000000000F8000-memory.dmp	disable_win_def

Deletes itself 1 IoCs

Processes:

cmd.exe

pid	Process
336	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
1704	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
808	PING.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

pid	Process
2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

description	pid	Process
Token: SeDebugPrivilege	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

pid	Process
2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe
2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.execmd.exe

description	pid	Process	procid_target
PID 2044 wrote to memory of 604	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	29
PID 2044 wrote to memory of 604	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	29
PID 2044 wrote to memory of 604	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	29
PID 2044 wrote to memory of 336	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	31
PID 2044 wrote to memory of 336	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	31
PID 2044 wrote to memory of 336	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	31
PID 2044 wrote to memory of 1704	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	33
PID 2044 wrote to memory of 1704	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	33
PID 2044 wrote to memory of 1704	2044	HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe	33
PID 336 wrote to memory of 808	336	cmd.exe	35
PID 336 wrote to memory of 808	336	cmd.exe	35
PID 336 wrote to memory of 808	336	cmd.exe	35

C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe
"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\system32\schtasks.exe
  "schtasks" /delete /tn "WindowsUpdate.exe" /f
  2⤵
  PID:604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 1.1.1.1 -n 5 -w 5000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe"
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 5 -w 5000
    3⤵
    - Runs ping.exe
    PID:808
- C:\Windows\system32\schtasks.exe
  "schtasks" /create /tn "WindowsUpdate.exe" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-bf0dae2bf317f6fd26f.exe" /rl HIGHEST /f
  2⤵
  - Creates scheduled task(s)
  PID:1704

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/336-58-0x0000000000000000-mapping.dmp

Download
memory/604-57-0x0000000000000000-mapping.dmp

Download
memory/808-60-0x0000000000000000-mapping.dmp

Download
memory/1704-59-0x0000000000000000-mapping.dmp

Download
memory/2044-54-0x00000000000C0000-0x00000000000F8000-memory.dmp

Filesize
224KB

Download
memory/2044-55-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download
memory/2044-56-0x000000001B1A9000-0x000000001B1C8000-memory.dmp

Filesize
124KB

Download
memory/2044-61-0x000000001B1A9000-0x000000001B1C8000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads