blacknet | eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b

General

Target

D867A6939E03FF1CCF63605DDDEA632E.exe
Size

195KB
MD5

d867a6939e03ff1ccf63605dddea632e
SHA1

b04f4689ac1ecd317387b28fad290f15a68878d9
SHA256

eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b
SHA512

28a848f5411c8af9e046ff37507f96da84790bdaf140fbae1526ce980cb0142d47f957de3a3f1a36a6a12c6e32c28f6706f06d770e4948a6ae3f74c3c628fba2
SSDEEP

1536:eZuhD5z28TC2PBttWjm38hPMsCoTgbSUPH4Lksi9WXU+pOk+G8wb/APcz+tBvqtu:7pmjm38QegbSKHanO1wbClvmYlVfm+

Score

10^/10

blacknet windows update evasion persistence trojan

Malware Config

Extracted

Family

blacknet

Botnet

Windows Update

C2

wOzx3g1DVutJaIF8JkCiLDWWDUVaGVAFT9MNNbf3GHejuL8mYQHtmLByJVduHMIIMCJOTkByRDSvMbknVYDMjFMd33ucCNGRd6rsd55Kjfz5N8toWqPtUAUWFp2VPBqwDphjXZsEuRw6KPvEHxNrRtmmNF3TSPIX5em2yZySCQTum749uJG4nmFWEHI/cH1NCAx4fFkBSOcgGykeOVQl1nGRgAHWZfv9g9qNaMeeu53b56HQWR/mZ6mTILTeO979h0iF42Y1WsHlP1Cd9xLI0jeNeBHY9FCS6EZPmLXKu/X9q8n26O7UQt6xg0ujFGbbUZ8glKZ26j6atQFXHOQGag==

Mutex

BN[fEVvWhbt-6079003]

Attributes

antivm
true
elevate_uac
true
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
35dcbc7eb742dd4f1edfbccf7826c724
startup
true
usb_spread
true

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe	family_blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe	disable_win_def

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

D867A6939E03FF1CCF63605DDDEA632E.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	D867A6939E03FF1CCF63605DDDEA632E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	D867A6939E03FF1CCF63605DDDEA632E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	D867A6939E03FF1CCF63605DDDEA632E.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	D867A6939E03FF1CCF63605DDDEA632E.exe

Executes dropped EXE 1 IoCs

Processes:

WindowsUpdate.exe

pid process

1968 WindowsUpdate.exe

pid	process
1968	WindowsUpdate.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

D867A6939E03FF1CCF63605DDDEA632E.exeWindowsUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	D867A6939E03FF1CCF63605DDDEA632E.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

D867A6939E03FF1CCF63605DDDEA632E.exeWindowsUpdate.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe"	D867A6939E03FF1CCF63605DDDEA632E.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe"	WindowsUpdate.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D867A6939E03FF1CCF63605DDDEA632E.exe"	D867A6939E03FF1CCF63605DDDEA632E.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

D867A6939E03FF1CCF63605DDDEA632E.exe

pid	process
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe
2256	D867A6939E03FF1CCF63605DDDEA632E.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

D867A6939E03FF1CCF63605DDDEA632E.exepowershell.exeWindowsUpdate.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2256	D867A6939E03FF1CCF63605DDDEA632E.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	1968	WindowsUpdate.exe
Token: SeDebugPrivilege	520	powershell.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

D867A6939E03FF1CCF63605DDDEA632E.exeWindowsUpdate.exe

description	pid	process	target process
PID 2256 wrote to memory of 1944	2256	D867A6939E03FF1CCF63605DDDEA632E.exe	powershell.exe
PID 2256 wrote to memory of 1944	2256	D867A6939E03FF1CCF63605DDDEA632E.exe	powershell.exe
PID 2256 wrote to memory of 1944	2256	D867A6939E03FF1CCF63605DDDEA632E.exe	powershell.exe
PID 2256 wrote to memory of 1968	2256	D867A6939E03FF1CCF63605DDDEA632E.exe	WindowsUpdate.exe
PID 2256 wrote to memory of 1968	2256	D867A6939E03FF1CCF63605DDDEA632E.exe	WindowsUpdate.exe
PID 2256 wrote to memory of 1968	2256	D867A6939E03FF1CCF63605DDDEA632E.exe	WindowsUpdate.exe
PID 1968 wrote to memory of 520	1968	WindowsUpdate.exe	powershell.exe
PID 1968 wrote to memory of 520	1968	WindowsUpdate.exe	powershell.exe
PID 1968 wrote to memory of 520	1968	WindowsUpdate.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\D867A6939E03FF1CCF63605DDDEA632E.exe
"C:\Users\Admin\AppData\Local\Temp\D867A6939E03FF1CCF63605DDDEA632E.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
2⤵
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

3

T1112

Impair Defenses

2

T1562

Disable or Modify Tools

2

T1562.001

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
Filesize
195KB

MD5
d867a6939e03ff1ccf63605dddea632e

SHA1
b04f4689ac1ecd317387b28fad290f15a68878d9

SHA256
eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b

SHA512
28a848f5411c8af9e046ff37507f96da84790bdaf140fbae1526ce980cb0142d47f957de3a3f1a36a6a12c6e32c28f6706f06d770e4948a6ae3f74c3c628fba2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-330940541-141609230-1670313778-1000\7fca30624ef576a22b26293309114fa3_4456596e-0528-4680-8940-5edc26c0ff50
Filesize
2KB

MD5
8de91c4f830956990012f9fd1269e490

SHA1
5396852c5a98d586d3970638bebf52ac4d7da6b9

SHA256
4b1f314ed0d2dd0aedd922297f2b16cce1d5716a24469b72a9e17ea43bc40433

SHA512
4c0ef84683613edb6196a43e2da73c58203e080cdee1c4119ad6b3823db137fec0628eb7fa8f34a7da93aa142a13b001168959d59cb425ae858372b5d7f2d555

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
cbb0e457beb164f21f31dc7fb1ab85d0

SHA1
9ec4dad4cae0864e947785f1704038ef0502d6cf

SHA256
5db23a5bf3e1e68b6ed13482ea8efa5fde140c7e2339c9d476a740e7425b3300

SHA512
5f9543d1cc366fec10b020910f5d53cec49ce6f9543b783a16606a514abbb315ef5edb440d55bfcabc03fc393299a440214ffa5822d9c2e8f1fa9fa9b7386b39

Download Submit
memory/1944-57-0x00000000027FB000-0x0000000002862000-memory.dmp

Filesize
412KB

Download
memory/1944-46-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1944-41-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/1944-47-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/1944-53-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/1944-29-0x00000000020C0000-0x00000000020C8000-memory.dmp

Filesize
32KB

Download
memory/1944-19-0x000000001B480000-0x000000001B762000-memory.dmp

Filesize
2.9MB

Download
memory/1944-56-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1968-83-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/1968-78-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/1968-79-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1968-58-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1968-55-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/1968-54-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/1968-81-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/1968-82-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/1968-85-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/1968-88-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/1968-87-0x0000000001FB0000-0x0000000002030000-memory.dmp

Filesize
512KB

Download
memory/2256-31-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-66-0x000000001E77F000-0x000000001E78F000-memory.dmp

Filesize
64KB

Download
memory/2256-37-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-34-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-33-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-48-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-49-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-52-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-51-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-50-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-32-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-1-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-30-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-28-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-20-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-18-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-59-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-72-0x000000001E6F7000-0x000000001E6FF000-memory.dmp

Filesize
32KB

Download
memory/2256-71-0x000000001E6EF000-0x000000001E6F7000-memory.dmp

Filesize
32KB

Download
memory/2256-70-0x000000001E6E7000-0x000000001E6EF000-memory.dmp

Filesize
32KB

Download
memory/2256-69-0x000000001E6DF000-0x000000001E6E7000-memory.dmp

Filesize
32KB

Download
memory/2256-68-0x000000001E6C3000-0x000000001E6C7000-memory.dmp

Filesize
16KB

Download
memory/2256-67-0x000000001E6BB000-0x000000001E6BF000-memory.dmp

Filesize
16KB

Download
memory/2256-40-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-65-0x000000001E6B7000-0x000000001E6BB000-memory.dmp

Filesize
16KB

Download
memory/2256-64-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-63-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-62-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-76-0x000000001E73F000-0x000000001E74F000-memory.dmp

Filesize
64KB

Download
memory/2256-74-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-75-0x000000001E72F000-0x000000001E73F000-memory.dmp

Filesize
64KB

Download
memory/2256-73-0x000000001E71F000-0x000000001E72F000-memory.dmp

Filesize
64KB

Download
memory/2256-61-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2256-77-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-60-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-13-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-11-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-80-0x000000001E6A0000-0x000000001E7A0000-memory.dmp

Filesize
1024KB

Download
memory/2256-12-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-10-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-9-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-8-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2256-3-0x0000000000B80000-0x0000000000C00000-memory.dmp

Filesize
512KB

Download
memory/2256-2-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download
memory/2256-0-0x000007FEF56E0000-0x000007FEF607D000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads