Overview

overview

10

Static

static

10

Botnets PA...t].exe

windows7-x64

8

Botnets PA...t].exe

windows10-2004-x64

8

Botnets PA...d9.dll

windows10-2004-x64

1

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...vg.exe

windows7-x64

3

Botnets PA...vg.exe

windows10-2004-x64

3

Botnets PA...til.js

windows7-x64

3

Botnets PA...til.js

windows10-2004-x64

3

Botnets PA...ib.dll

windows7-x64

1

Botnets PA...ib.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...mm.exe

windows7-x64

3

Botnets PA...mm.exe

windows10-2004-x64

3

Botnets PA...UI.exe

windows7-x64

8

Botnets PA...UI.exe

windows10-2004-x64

8

Botnets PA...ce.dll

windows10-2004-x64

1

Botnets PA...ip.dll

windows7-x64

1

Botnets PA...ip.dll

windows10-2004-x64

1

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Botnets PA...32.exe

windows7-x64

3

Botnets PA...32.exe

windows10-2004-x64

3

Botnets PA...er.exe

windows7-x64

8

Botnets PA...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    154s
  • max time network
    21s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    09-08-2024 19:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Botnets PACK/Botnets PACK/BlackNET - Compiled/BlackNET Builder.exe

  • Size

    176KB

  • MD5

    4e548a7c6eab54dd088499693ec80de0

  • SHA1

    14dc314730672cdcc0d149dbc394457a729f477d

  • SHA256

    3eef584ad9c9cee94f1e5a9950baa4b9b68d628e6d3ad9e02b2eb53e88d9293b

  • SHA512

    e0539f8a6fbdf621578c6365e87749b055c5d61a816a28cc6c77fe59bc7aaa2ceac9f86861df4c25f1c8600a408e8ae892886359b78cb15907153cdddec517a2

  • SSDEEP

    768:4ec4lj/7ePn43diJmBah5xoaJUQiVfKvMi:Y4lHePIdkmW5xomjefKvMi

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Loads dropped DLL 49 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BlackNET - Compiled\BlackNET Builder.exe
    "C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BlackNET - Compiled\BlackNET Builder.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BlackNET - Compiled\aepic\Launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BlackNET - Compiled\aepic\Launcher.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2644
      • C:\Windows\IMF\Windows Services.exe
        "C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2196
        • C:\Windows\IMF\Secure System Shell.exe
          "C:\Windows\IMF\Secure System Shell.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2320
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1928
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2872
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2256
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2976
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1504
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2028
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2092
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1240
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1740
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2520
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1688
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:776
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2444
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1148
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:864
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2100
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1896
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2136
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2104
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2800
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2684
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:2692
        • C:\Windows\IMF\Runtime Explorer.exe
          "C:\Windows\IMF\Runtime Explorer.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1960
    • C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BlackNET - Compiled\aepic\RESOURCES.exe
      "C:\Users\Admin\AppData\Local\Temp\Botnets PACK\Botnets PACK\BlackNET - Compiled\aepic\RESOURCES.exe"
      2⤵
        PID:2840

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\IMF\Runtime Explorer.exe
      Filesize

      144KB

      MD5

      ec70c6f4dc443c5ab2b91d64ae04fa8e

      SHA1

      43eb3b3289782fced204f0b4e3edad2ba1b085b7

      SHA256

      276f1bfc6256f4c1ddd544d5a556d299ebddcf200a64ee7c9c3edef686df727d

      SHA512

      6217c232edbcf60ae1337120aa9b51956e06f591c660fd720b02fe8abf01923dd4dca28f69ece88c12c705a4c3a392d0cbb6f4f6c6759306123db141ed05d584

      Download Submit

    • C:\Windows\IMF\Secure System Shell.exe
      Filesize

      45KB

      MD5

      7d0c7359e5b2daa5665d01afdc98cc00

      SHA1

      c3cc830c8ffd0f53f28d89dcd9f3426be87085cb

      SHA256

      f1abd5ab03189e82971513e6ca04bd372fcf234d670079888f01cf4addd49809

      SHA512

      a8f82b11b045d8dd744506f4f56f3382b33a03684a6aebc91a02ea901c101b91cb43b7d0213f72f39cbb22f616ecd5de8b9e6c99fb5669f26a3ea6bcb63c8407

      Download Submit

    • C:\Windows\IMF\Windows Services.exe
      Filesize

      46KB

      MD5

      ad0ce1302147fbdfecaec58480eb9cf9

      SHA1

      874efbc76e5f91bc1425a43ea19400340f98d42b

      SHA256

      2c339b52b82e73b4698a0110cdfe310c00c5c69078e9e1bd6fa1308652bf82a3

      SHA512

      adccd5520e01b673c2fc5c451305fe31b1a3e74891aece558f75fefc50218adf1fb81bb8c7f19969929d3fecb0fdb2cb5b564400d51e0a5a1ad8d5bc2d4eed53

      Download Submit

    • memory/2196-43-0x0000000001330000-0x0000000001342000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2244-44-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2244-3-0x0000000001260000-0x0000000001274000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2244-4-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2244-5-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2244-6-0x0000000000C90000-0x0000000000D0E000-memory.dmp

      Filesize

      504KB

      Download

    • memory/2244-7-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2320-52-0x0000000000340000-0x0000000000352000-memory.dmp

      Filesize

      72KB

      Download

    • memory/2456-8-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2456-0-0x000000007425E000-0x000000007425F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2456-2-0x0000000074250000-0x000000007493E000-memory.dmp

      Filesize

      6.9MB

      Download

    • memory/2456-1-0x0000000000C50000-0x0000000000C82000-memory.dmp

      Filesize

      200KB

      Download

    • memory/2840-32-0x00000000010E0000-0x00000000011AA000-memory.dmp

      Filesize

      808KB

      Download