blacknet | 8e61a79a823db1957e7cd2e4827ca45bac8e762cb85f54d67c775b754f9f3b2c

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-06-2023 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe
Size

232KB
MD5

6dcf085eab95ba037b39c7222b57aac9
SHA1

d5bb20090cde00a3ff1f485d12f0811838983dd6
SHA256

8e61a79a823db1957e7cd2e4827ca45bac8e762cb85f54d67c775b754f9f3b2c
SHA512

f1da79d2a07e1acc7708a9610799564833a6dd6eed19be4971452bfe357fb6425b4c1f668823ae726b1582a6a199f5799dc59b88d7f3611643ab5b47d22c7bef
SSDEEP

3072:j9Kqrr1c8ELV5w/oV9sZACVbQr/xdUf/A8:m8xZzbsY

Score

10^/10

blacknet trojan

Malware Config

Extracted

Family

blacknet

Attributes

antivm
false
elevate_uac
false
install_name
splitter
start_name
startup
false
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1060-54-0x00000000000F0000-0x000000000012A000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1060-54-0x00000000000F0000-0x000000000012A000-memory.dmp	disable_win_def

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1100 1060 WerFault.exe 2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe

pid	pid_target	process	target process
1100	1060	WerFault.exe	2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe

description	pid	process	target process
PID 1060 wrote to memory of 1100	1060	2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe	WerFault.exe
PID 1060 wrote to memory of 1100	1060	2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe	WerFault.exe
PID 1060 wrote to memory of 1100	1060	2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1060 -s 488
2⤵
- Program crash
PID:1100

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-54-0x00000000000F0000-0x000000000012A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads