Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06-03-2024 10:18
Behavioral task
behavioral1
Sample
b72d429d1d690165c7b0de4a074c4a58.exe
Resource
win7-20240221-en
General
-
Target
b72d429d1d690165c7b0de4a074c4a58.exe
-
Size
117KB
-
MD5
b72d429d1d690165c7b0de4a074c4a58
-
SHA1
f0704d227482a80f2f90dab79ed4acd9770fe565
-
SHA256
b30eebf734354f55373978e395c912393f3c674aaa4717748ae449b09832f6ae
-
SHA512
f3b565e67d5a15d5305982701bd5f0d37eec0bfe2d152556584fa1d01faf1def6e616d0addea91e0663be084450b49f99e2108cc06a9b50c9e1482f9290b6c5c
-
SSDEEP
3072:qwS9xonGdoFlC5w/oV9RRKyfKW63beFEKyBFfa1:5CeSKyRPfKWybi1
Malware Config
Extracted
blacknet
v3.7.0 Public
Bot
http://furyx.de/panel
BN[c1916af6f3a468e5b6f5c7f6b9c78982]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
false
-
usb_spread
true
Signatures
-
BlackNET payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2612-0-0x0000000000F50000-0x0000000000F72000-memory.dmp family_blacknet -
Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule behavioral2/memory/2612-0-0x0000000000F50000-0x0000000000F72000-memory.dmp disable_win_def -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
b72d429d1d690165c7b0de4a074c4a58.exepid process 2612 b72d429d1d690165c7b0de4a074c4a58.exe 2612 b72d429d1d690165c7b0de4a074c4a58.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2612-0-0x0000000000F50000-0x0000000000F72000-memory.dmpFilesize
136KB
-
memory/2612-1-0x00007FF841DC0000-0x00007FF842881000-memory.dmpFilesize
10.8MB
-
memory/2612-2-0x000000001BB50000-0x000000001BB60000-memory.dmpFilesize
64KB
-
memory/2612-3-0x00007FF841DC0000-0x00007FF842881000-memory.dmpFilesize
10.8MB