Analysis
- max time kernel
90s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
29/01/2023, 19:29
General
- Target 91c23be6780cd10b2f46371601701182302a0f214f8b01028def69aadee0410a.exe
- Size 873KB
- Sample230129-x7le5scd2w
- SHA256 91c23be6780cd10b2f46371601701182302a0f214f8b01028def69aadee0410a
Malware Config
Extracted
-
blacknet
-
v3.7.0 Public
-
WF6Fo4
-
http://185.239.242.77/fucku/getwrecked/fockbot/
-
BN[98f274ee7dffa0a483bf6aae80c1bed1]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET payload 1 IoCs
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Executes dropped EXE 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\91c23be6780cd10b2f46371601701182302a0f214f8b01028def69aadee0410a.exe"C:\Users\Admin\AppData\Local\Temp\91c23be6780cd10b2f46371601701182302a0f214f8b01028def69aadee0410a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 1.1.1.1 -n 5 -w 5000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 5 -w 50004⤵
- Runs ping.exe
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
InstallUtil.exe
InstallUtil.exe
memory/1620-142-0x00000000003E0000-0x00000000003FE000-memory.dmp
memory/1620-143-0x0000000004B40000-0x0000000004B4A000-memory.dmp
memory/1620-144-0x0000000004DA0000-0x0000000004DF6000-memory.dmp
memory/2096-135-0x00000000059A0000-0x0000000005A3C000-memory.dmp
memory/2096-136-0x00000000081A0000-0x0000000008206000-memory.dmp
memory/2096-137-0x0000000008160000-0x0000000008182000-memory.dmp
memory/2096-134-0x00000000055A0000-0x0000000005632000-memory.dmp
memory/2096-133-0x0000000005B50000-0x00000000060F4000-memory.dmp
memory/2096-132-0x0000000000A80000-0x0000000000B5E000-memory.dmp