blacknet | a7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98b

General

Target

NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
Size

75KB
MD5

8ce1041cce94737d4a36dbad504f4a78
SHA1

c4a49dcf6c6edff26b0514da03b155f2ac418a3c
SHA256

a7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98b
SHA512

bd694408ac0a128028557c4f77b82e4d581c3ddb4326804de0dd1e5547d9f5287f219ef3af92394e70d377e08e4f49d4530acb1941fdc090856b6e4d2bdfc162
SSDEEP

1536:hZuhD5z28TC268is9T8VPPQTgbSUPH4LU0tYwq:Gt19T89mgbSKHaUoYw

Score

10^/10

blacknet evasion trojan

Malware Config

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
488	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
488	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
488	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
2816	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	488	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
Token: SeDebugPrivilege	2816	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 2816	488	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe	29
PID 488 wrote to memory of 2816	488	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe	29
PID 488 wrote to memory of 2816	488	NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEASa7758f03d40f51f6c0b3f84e40fb7e5ae468fd315d6c4ea2b67b664d347fc98bexeexe_JC.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-13-0x0000000000A50000-0x0000000000AD0000-memory.dmp

Filesize
512KB

Download
memory/488-1-0x0000000000A50000-0x0000000000AD0000-memory.dmp

Filesize
512KB

Download
memory/488-2-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/488-3-0x0000000000A50000-0x0000000000AD0000-memory.dmp

Filesize
512KB

Download
memory/488-8-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/488-15-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/488-0-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2816-10-0x000000001B330000-0x000000001B612000-memory.dmp

Filesize
2.9MB

Download
memory/2816-14-0x0000000002860000-0x00000000028E0000-memory.dmp

Filesize
512KB

Download
memory/2816-12-0x0000000002860000-0x00000000028E0000-memory.dmp

Filesize
512KB

Download
memory/2816-11-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/2816-9-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download
memory/2816-16-0x0000000002860000-0x00000000028E0000-memory.dmp

Filesize
512KB

Download
memory/2816-17-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads