blacknet | a25f5a796b86f95ab6e7cfb0ad7f8bef109748ff4667477697dea597180d1d7a

Analysis

max time kernel
123s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2023 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d745d5bb38d4bd8f13ff66551772efe.exe
Size

1.1MB
MD5

2d745d5bb38d4bd8f13ff66551772efe
SHA1

6ccbd6fac2c228173b80caddaed057af5cc22d8d
SHA256

a25f5a796b86f95ab6e7cfb0ad7f8bef109748ff4667477697dea597180d1d7a
SHA512

70e736171ad1d5aee0d68b247fbe0afd415bc630399e4555a91dd43792794cd723912962a2a20f900a85bdd58040c20210c74e8f1b4456538003d18df7cae146
SSDEEP

24576:CcHSyExY6ViWhAkezLjJ9I9WSRJSBAIwDsJsT9dJdKspBBjgb:Coeb7ez7I9WdB5wDwsThdKspBBjg

Score

10^/10

blacknet persistence trojan

Malware Config

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2d745d5bb38d4bd8f13ff66551772efe.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\68b4a4f47850fb62cd2157162048241c = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2d745d5bb38d4bd8f13ff66551772efe.exe"	2d745d5bb38d4bd8f13ff66551772efe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\68b4a4f47850fb62cd2157162048241c = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe"	2d745d5bb38d4bd8f13ff66551772efe.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

Processes:

2d745d5bb38d4bd8f13ff66551772efe.exe

pid	process
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

2d745d5bb38d4bd8f13ff66551772efe.exe

pid	process
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe
3808	2d745d5bb38d4bd8f13ff66551772efe.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

2d745d5bb38d4bd8f13ff66551772efe.exe

description pid process

Token: SeDebugPrivilege 3808 2d745d5bb38d4bd8f13ff66551772efe.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

2d745d5bb38d4bd8f13ff66551772efe.exe

pid process

3808 2d745d5bb38d4bd8f13ff66551772efe.exe
3808 2d745d5bb38d4bd8f13ff66551772efe.exe
3808 2d745d5bb38d4bd8f13ff66551772efe.exe

description	pid	process
Token: SeDebugPrivilege	3808	2d745d5bb38d4bd8f13ff66551772efe.exe

C:\Users\Admin\AppData\Local\Temp\2d745d5bb38d4bd8f13ff66551772efe.exe
"C:\Users\Admin\AppData\Local\Temp\2d745d5bb38d4bd8f13ff66551772efe.exe"
1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3808

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3808-0-0x0000000000AF0000-0x0000000000E7C000-memory.dmp

Filesize
3.5MB

Download
memory/3808-1-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/3808-2-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/3808-3-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/3808-5-0x0000000000AF0000-0x0000000000E7C000-memory.dmp

Filesize
3.5MB

Download
memory/3808-8-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/3808-7-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/3808-9-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/3808-11-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/3808-10-0x00000000746C0000-0x0000000074C71000-memory.dmp

Filesize
5.7MB

Download
memory/3808-12-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/3808-15-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/3808-16-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download
memory/3808-17-0x0000000003750000-0x0000000003760000-memory.dmp

Filesize
64KB

Download