blacknet | 5b14d9674cbd536403423c9822182497469034a86ad12ced50ab02bdc9166cce

General

Target

5de9dcc57b578bf915e553ae272269dc.exe
Size

684KB
MD5

5de9dcc57b578bf915e553ae272269dc
SHA1

162ef6514901b7783261eb12f68f8798dc0e8f3d
SHA256

5b14d9674cbd536403423c9822182497469034a86ad12ced50ab02bdc9166cce
SHA512

98f2d30c39ef4706ed95579dfccf6e6637b5643c06c41dcc0dd4f61f6628f1d9691684b92699045b80486313fbb9d076e734419d83e31a036c36a1e30cd7dff5
SSDEEP

6144:XkKRDBCU++To9SLXGvRitOcpuAtk42a85SZvmSj/IHhiohh0RZHy4Y4uGtBzcVT:PgSLGI4AgJ5SZ9QHhhCXqGPz

Score

10^/10

blacknet d7tj7v evasion trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

D7tJ7v

C2

http://officialcomerce1.xyz/lee

Mutex

BN[f9a1b17a]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2648-15-0x0000000000400000-0x000000000041E000-memory.dmp	family_blacknet
behavioral1/memory/2648-16-0x0000000000400000-0x000000000041E000-memory.dmp	family_blacknet
behavioral1/memory/2648-19-0x0000000000400000-0x000000000041E000-memory.dmp	family_blacknet
behavioral1/memory/2648-21-0x0000000000400000-0x000000000041E000-memory.dmp	family_blacknet
behavioral1/memory/2648-23-0x0000000000400000-0x000000000041E000-memory.dmp	family_blacknet
behavioral1/memory/2648-26-0x0000000004920000-0x0000000004960000-memory.dmp	family_blacknet

Contains code to disable Windows Defender 6 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2648-15-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def
behavioral1/memory/2648-16-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def
behavioral1/memory/2648-19-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def
behavioral1/memory/2648-21-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def
behavioral1/memory/2648-23-0x0000000000400000-0x000000000041E000-memory.dmp	disable_win_def
behavioral1/memory/2648-26-0x0000000004920000-0x0000000004960000-memory.dmp	disable_win_def

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

5de9dcc57b578bf915e553ae272269dc.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions 5de9dcc57b578bf915e553ae272269dc.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

5de9dcc57b578bf915e553ae272269dc.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 5de9dcc57b578bf915e553ae272269dc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	5de9dcc57b578bf915e553ae272269dc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	5de9dcc57b578bf915e553ae272269dc.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5de9dcc57b578bf915e553ae272269dc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5de9dcc57b578bf915e553ae272269dc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5de9dcc57b578bf915e553ae272269dc.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

5de9dcc57b578bf915e553ae272269dc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	5de9dcc57b578bf915e553ae272269dc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	5de9dcc57b578bf915e553ae272269dc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5de9dcc57b578bf915e553ae272269dc.exe

description pid process target process

PID 3064 set thread context of 2648 3064 5de9dcc57b578bf915e553ae272269dc.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2756 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2432 PING.EXE
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

RegSvcs.exe

pid process

2648 RegSvcs.exe
2648 RegSvcs.exe
2648 RegSvcs.exe
2648 RegSvcs.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

RegSvcs.exe

description pid process

Token: SeDebugPrivilege 2648 RegSvcs.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

RegSvcs.exe

pid process

2648 RegSvcs.exe
2648 RegSvcs.exe
2648 RegSvcs.exe

description	pid	process	target process
PID 3064 set thread context of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe

pid	process
2756	schtasks.exe

pid	process
2432	PING.EXE

pid	process
2648	RegSvcs.exe
2648	RegSvcs.exe
2648	RegSvcs.exe
2648	RegSvcs.exe

description	pid	process
Token: SeDebugPrivilege	2648	RegSvcs.exe

pid	process
2648	RegSvcs.exe
2648	RegSvcs.exe
2648	RegSvcs.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

5de9dcc57b578bf915e553ae272269dc.exeRegSvcs.execmd.exe

description	pid	process	target process
PID 3064 wrote to memory of 2756	3064	5de9dcc57b578bf915e553ae272269dc.exe	schtasks.exe
PID 3064 wrote to memory of 2756	3064	5de9dcc57b578bf915e553ae272269dc.exe	schtasks.exe
PID 3064 wrote to memory of 2756	3064	5de9dcc57b578bf915e553ae272269dc.exe	schtasks.exe
PID 3064 wrote to memory of 2756	3064	5de9dcc57b578bf915e553ae272269dc.exe	schtasks.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 3064 wrote to memory of 2648	3064	5de9dcc57b578bf915e553ae272269dc.exe	RegSvcs.exe
PID 2648 wrote to memory of 3052	2648	RegSvcs.exe	cmd.exe
PID 2648 wrote to memory of 3052	2648	RegSvcs.exe	cmd.exe
PID 2648 wrote to memory of 3052	2648	RegSvcs.exe	cmd.exe
PID 2648 wrote to memory of 3052	2648	RegSvcs.exe	cmd.exe
PID 3052 wrote to memory of 2432	3052	cmd.exe	PING.EXE
PID 3052 wrote to memory of 2432	3052	cmd.exe	PING.EXE
PID 3052 wrote to memory of 2432	3052	cmd.exe	PING.EXE
PID 3052 wrote to memory of 2432	3052	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\5de9dcc57b578bf915e553ae272269dc.exe
"C:\Users\Admin\AppData\Local\Temp\5de9dcc57b578bf915e553ae272269dc.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TiqvqaWbL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB6D1.tmp"
2⤵
- Creates scheduled task(s)
PID:2756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"{path}"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 1.1.1.1 -n 5 -w 5000 > Nul & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3052

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 5 -w 5000
4⤵
- Runs ping.exe
PID:2432

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Query Registry

4

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB6D1.tmp
Filesize
1KB

MD5
f3591bce2492abcc6648df18de579df1

SHA1
3bfb5ca5295fc302a2ef77255a11ce7e8f2fc67d

SHA256
82398bd2872d9226d6583a4d01c872877c0f4c0f4a40b1423ba912ba2a7ed60d

SHA512
b16f1f275a29ce6def6386e0b5532335ae6602d435c8a048eb589bf19eaba59a8cc43ccfe57b0f1f8d86ee46af2211fb68dd55837418c917b08d07e060109395

Download Submit
memory/2648-28-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/2648-21-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-19-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-27-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/2648-26-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/2648-25-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-23-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-29-0x0000000004920000-0x0000000004960000-memory.dmp

Filesize
256KB

Download
memory/2648-30-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-12-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-14-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-15-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-16-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2648-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3064-6-0x0000000004770000-0x00000000047B0000-memory.dmp

Filesize
256KB

Download
memory/3064-8-0x00000000020C0000-0x00000000020E8000-memory.dmp

Filesize
160KB

Download
memory/3064-7-0x0000000008010000-0x0000000008086000-memory.dmp

Filesize
472KB

Download
memory/3064-24-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/3064-1-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/3064-5-0x0000000004770000-0x00000000047B0000-memory.dmp

Filesize
256KB

Download
memory/3064-4-0x00000000745D0000-0x0000000074CBE000-memory.dmp

Filesize
6.9MB

Download
memory/3064-3-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/3064-2-0x0000000004770000-0x00000000047B0000-memory.dmp

Filesize
256KB

Download
memory/3064-0-0x00000000002E0000-0x0000000000392000-memory.dmp

Filesize
712KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads