Analysis
-
max time kernel
45s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
18/06/2023, 07:32
General
-
Target
HEUR-Trojan.Win32.Generic-4d178e10389731a660d.exe
-
Size
183KB
-
MD5
d677c626953c9ba17b3d094a83b1048e
-
SHA1
bf78af289038b4c088b7679a3d08627dac4883bd
-
SHA256
4d178e10389731a660d8dc1240f6d64723aae55ad953150bed2520d2c39e6644
-
SHA512
a6089df6a109ce91644e338b98ee9de96fa1a13040315e05ccac4afd362233cbbb8057cf5bb66de606c9231059d5bde29ab6cd92fb811bf086057a311fc60418
-
SSDEEP
1536:XgzTtxCCkI7Yq0GzAc4xYEwbJbSDzlkW3zzxV/A8:QzTeLuzAGbJUGWv/A8
Malware Config
Extracted
blacknet
-
antivm
false
-
elevate_uac
false
- install_name
- splitter
- start_name
-
startup
false
-
usb_spread
false
Signatures
-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
BlackNET payload 2 IoCs
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-4d178e10389731a660d.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-4d178e10389731a660d.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\Microsoft\MyClient\defenderr.exe"C:\ProgramData\Microsoft\MyClient\defenderr.exe"2⤵
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1652 -s 312523⤵
- Program crash
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183KB
MD5d677c626953c9ba17b3d094a83b1048e
SHA1bf78af289038b4c088b7679a3d08627dac4883bd
SHA2564d178e10389731a660d8dc1240f6d64723aae55ad953150bed2520d2c39e6644
SHA512a6089df6a109ce91644e338b98ee9de96fa1a13040315e05ccac4afd362233cbbb8057cf5bb66de606c9231059d5bde29ab6cd92fb811bf086057a311fc60418
-
Filesize
183KB
MD5d677c626953c9ba17b3d094a83b1048e
SHA1bf78af289038b4c088b7679a3d08627dac4883bd
SHA2564d178e10389731a660d8dc1240f6d64723aae55ad953150bed2520d2c39e6644
SHA512a6089df6a109ce91644e338b98ee9de96fa1a13040315e05ccac4afd362233cbbb8057cf5bb66de606c9231059d5bde29ab6cd92fb811bf086057a311fc60418
-
Filesize
7KB
MD591efbdb32f3d4a1f8f41a922da3b293c
SHA143542858d0a48cc293ab66b9b6d86bc66b20f7ca
SHA2569b9c4c6ec3ec32e5d7485358e7b9ab03fcf62bd99114da723a27f87db1a1df41
SHA512135edfdf6d7f54089a3da9311c44b0dbdc5a674591beeb62fe85d29b4c8d5f9a36116aab1ec13e1d366e6c329e6a7bc5ae9811ef858eb1c0421b42ed997f85ff
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
220KB
-
Filesize
512KB
-
Filesize
2.9MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
220KB
-
Filesize
208KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
232KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
208KB
-
Filesize
64KB
-
Filesize
16KB
-
Filesize
20KB
-
Filesize
32KB