Overview

overview

10

Static

static

10

2000-55-0x...ry.exe

windows7-x64

10

2000-55-0x...ry.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    83s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/06/2023, 19:11

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe

  • Size

    232KB

  • MD5

    6dcf085eab95ba037b39c7222b57aac9

  • SHA1

    d5bb20090cde00a3ff1f485d12f0811838983dd6

  • SHA256

    8e61a79a823db1957e7cd2e4827ca45bac8e762cb85f54d67c775b754f9f3b2c

  • SHA512

    f1da79d2a07e1acc7708a9610799564833a6dd6eed19be4971452bfe357fb6425b4c1f668823ae726b1582a6a199f5799dc59b88d7f3611643ab5b47d22c7bef

  • SSDEEP

    3072:j9Kqrr1c8ELV5w/oV9sZACVbQr/xdUf/A8:m8xZzbsY

Score
10/10
blacknettrojan

Malware Config

Extracted

Family

blacknet

Attributes
  • antivm

    false

  • elevate_uac

    false

  • install_name

  • splitter

  • start_name

  • startup

    false

  • usb_spread

    false

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet
  • BlackNET payload 1 IoCs
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe
    "C:\Users\Admin\AppData\Local\Temp\2000-55-0x00000000001A0000-0x00000000001DA000-memory.exe"
    1⤵
      PID:2432
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2432 -s 704
        2⤵
        • Program crash
        PID:772
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 184 -p 2432 -ip 2432
      1⤵
        PID:4672

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2432-133-0x0000000000D90000-0x0000000000DCA000-memory.dmp

        Filesize

        232KB

        Download