blacknet | 8e61a79a823db1957e7cd2e4827ca45bac8e762cb85f54d67c775b754f9f3b2c

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
18-06-2023 19:11

Target

2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe
Size

232KB
MD5

6dcf085eab95ba037b39c7222b57aac9
SHA1

d5bb20090cde00a3ff1f485d12f0811838983dd6
SHA256

8e61a79a823db1957e7cd2e4827ca45bac8e762cb85f54d67c775b754f9f3b2c
SHA512

f1da79d2a07e1acc7708a9610799564833a6dd6eed19be4971452bfe357fb6425b4c1f668823ae726b1582a6a199f5799dc59b88d7f3611643ab5b47d22c7bef
SSDEEP

3072:j9Kqrr1c8ELV5w/oV9sZACVbQr/xdUf/A8:m8xZzbsY

Score

10^/10

blacknet trojan

Family

blacknet

Attributes

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

resource	yara_rule
behavioral1/memory/1060-54-0x00000000000F0000-0x000000000012A000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/1060-54-0x00000000000F0000-0x000000000012A000-memory.dmp	disable_win_def

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	1060	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1100	1060	2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe	28
PID 1060 wrote to memory of 1100	1060	2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe	28
PID 1060 wrote to memory of 1100	1060	2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1060 -s 488
  2⤵
  - Program crash
  PID:1100

memory/1060-54-0x00000000000F0000-0x000000000012A000-memory.dmp

Filesize
232KB

Download