blacknet | db6259355ec56182ea812b282e9eb98743a947f77ddba81bd5a8f884f5387ece

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
15-06-2023 01:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02.exe
Size

102KB
MD5

e162b1333458a713bc6916cc8ac4110c
SHA1

7053e1ae3e60b42f9fb8850f8a727099530c8fcd
SHA256

2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02
SHA512

9a508117a757e4fcf192916641c77e26769e5939b6c3fa078fedad9a2821e24e69de0da74dd0cbff0309aa28cd813599dc261ded932a711dfdbb80c7ea3b353a
SSDEEP

3072:BW8APjq+thIi0nPFhBbxCTomsVQYcU363K75rVzQgWzeuyb1X4Lt/VYLl4ECizQh:A8APwPFhBbxCTomsVQYc463K75rVzNW1

Score

10^/10

blacknet [id]trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

[ID]

[HOST]

Mutex

[MUTEX]

Attributes

antivm
false
elevate_uac
false
install_name
[Install_Name]
splitter
[Splitter]
start_name
[StartupName]
startup
false
usb_spread
false

aes.plain

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 2 IoCs

resource	yara_rule
behavioral1/memory/2004-54-0x0000000000BC0000-0x0000000000BE0000-memory.dmp	family_blacknet
behavioral1/memory/2004-55-0x000000001B120000-0x000000001B1A0000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2004-54-0x0000000000BC0000-0x0000000000BE0000-memory.dmp	disable_win_def
behavioral1/memory/2004-55-0x000000001B120000-0x000000001B1A0000-memory.dmp	disable_win_def

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1692	2004	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1692	2004	2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02.exe	28
PID 2004 wrote to memory of 1692	2004	2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02.exe	28
PID 2004 wrote to memory of 1692	2004	2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02.exe	28

C:\Users\Admin\AppData\Local\Temp\2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02.exe
"C:\Users\Admin\AppData\Local\Temp\2b3b8c1083bb3e4524b758a755cf17fbb352aa92d272912997bd0674365d6d02.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2004 -s 616
  2⤵
  - Program crash
  PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-54-0x0000000000BC0000-0x0000000000BE0000-memory.dmp

Filesize
128KB

Download
memory/2004-55-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download
memory/2004-56-0x000000001B120000-0x000000001B1A0000-memory.dmp

Filesize
512KB

Download