Analysis
-
max time kernel
15s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
05-03-2024 02:54
General
-
Target
eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b.exe
-
Size
195KB
-
MD5
d867a6939e03ff1ccf63605dddea632e
-
SHA1
b04f4689ac1ecd317387b28fad290f15a68878d9
-
SHA256
eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b
-
SHA512
28a848f5411c8af9e046ff37507f96da84790bdaf140fbae1526ce980cb0142d47f957de3a3f1a36a6a12c6e32c28f6706f06d770e4948a6ae3f74c3c628fba2
-
SSDEEP
1536:eZuhD5z28TC2PBttWjm38hPMsCoTgbSUPH4Lksi9WXU+pOk+G8wb/APcz+tBvqtu:7pmjm38QegbSKHanO1wbClvmYlVfm+
Malware Config
Extracted
blacknet
Windows Update
wOzx3g1DVutJaIF8JkCiLDWWDUVaGVAFT9MNNbf3GHejuL8mYQHtmLByJVduHMIIMCJOTkByRDSvMbknVYDMjFMd33ucCNGRd6rsd55Kjfz5N8toWqPtUAUWFp2VPBqwDphjXZsEuRw6KPvEHxNrRtmmNF3TSPIX5em2yZySCQTum749uJG4nmFWEHI/cH1NCAx4fFkBSOcgGykeOVQl1nGRgAHWZfv9g9qNaMeeu53b56HQWR/mZ6mTILTeO979h0iF42Y1WsHlP1Cd9xLI0jeNeBHY9FCS6EZPmLXKu/X9q8n26O7UQt6xg0ujFGbbUZ8glKZ26j6atQFXHOQGag==
BN[fEVvWhbt-6079003]
-
antivm
true
-
elevate_uac
true
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
35dcbc7eb742dd4f1edfbccf7826c724
-
startup
true
-
usb_spread
true
Signatures
-
BlackNET
BlackNET is an open source remote access tool written in VB.NET.
-
BlackNET payload 1 IoCs
-
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
-
Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
-
Detects executables embedding registry key / value combination indicative of disabling Windows Defender features 1 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b.exe"C:\Users\Admin\AppData\Local\Temp\eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
195KB
MD5d867a6939e03ff1ccf63605dddea632e
SHA1b04f4689ac1ecd317387b28fad290f15a68878d9
SHA256eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b
SHA51228a848f5411c8af9e046ff37507f96da84790bdaf140fbae1526ce980cb0142d47f957de3a3f1a36a6a12c6e32c28f6706f06d770e4948a6ae3f74c3c628fba2
-
Filesize
2KB
MD58de91c4f830956990012f9fd1269e490
SHA15396852c5a98d586d3970638bebf52ac4d7da6b9
SHA2564b1f314ed0d2dd0aedd922297f2b16cce1d5716a24469b72a9e17ea43bc40433
SHA5124c0ef84683613edb6196a43e2da73c58203e080cdee1c4119ad6b3823db137fec0628eb7fa8f34a7da93aa142a13b001168959d59cb425ae858372b5d7f2d555
-
Filesize
7KB
MD5ee5f67b433a8e06762602f1383d09a97
SHA16daca5d77021082b3e283be396180e8c6b524a17
SHA2562800953a9661161c2d1ab1edd71170e758c9138e3f2cb0e81fbe959cee8ab817
SHA51256b35917a2fa29e08f959fc7f541918d7836e374316bcfd73a1a974c3e00860184bc7d4ac1a09f581890c775624e9df663a40dbf4c915bdd5e55d68958074484
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
412KB
-
Filesize
512KB
-
Filesize
12KB
-
Filesize
9.6MB
-
Filesize
2.9MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
1024KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
1024KB
-
Filesize
512KB
-
Filesize
1024KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
1024KB
-
Filesize
2.0MB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
1024KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1024KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.6MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
12KB
-
Filesize
2.9MB
-
Filesize
412KB
-
Filesize
512KB