blacknet | cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19da

Analysis

max time kernel
16s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe
Size

7.0MB
MD5

914d87aeb3a53de125a809f3fbe12770
SHA1

cf9a2c842f3ff8c45b7daf9e169993ae289362b5
SHA256

cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19da
SHA512

7fc1ec6a545edf23da49fc7221b29c12f34bb4fec57b8b45ea66571466b4ddecb3d405d4d6d76d60d695d8e75e35b95e70349cf93b6998ecf81c18e677db974f
SSDEEP

196608:zqV2NBKA1HeT39Iig5Tet4Q4G/NsINyzWWAMYI93:2V2fj1+TtIiOS1NsIkzWWAcx

Score

10^/10

blacknet persistence trojan

Malware Config

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x00070000000234af-30.dat	family_blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral2/files/0x00070000000234af-30.dat	disable_win_def

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exedecrypted_mXiTDRFpPk.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	decrypted_mXiTDRFpPk.exe

Executes dropped EXE 2 IoCs

Processes:

decrypted_mXiTDRFpPk.exeWindowsUpdate.exe

pid	Process
8	decrypted_mXiTDRFpPk.exe
540	WindowsUpdate.exe

Loads dropped DLL 4 IoCs

Processes:

cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe

pid	Process
1696	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe
1696	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe
1696	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe
1696	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

decrypted_mXiTDRFpPk.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\decrypted_mXiTDRFpPk.exe"	decrypted_mXiTDRFpPk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe"	decrypted_mXiTDRFpPk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 57 IoCs

Processes:

decrypted_mXiTDRFpPk.exe

pid	Process
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe
8	decrypted_mXiTDRFpPk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

decrypted_mXiTDRFpPk.exe

description	pid	Process
Token: SeDebugPrivilege	8	decrypted_mXiTDRFpPk.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.execdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exedecrypted_mXiTDRFpPk.exe

description	pid	Process	procid_target
PID 1672 wrote to memory of 1696	1672	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe	82
PID 1672 wrote to memory of 1696	1672	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe	82
PID 1696 wrote to memory of 8	1696	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe	83
PID 1696 wrote to memory of 8	1696	cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe	83
PID 8 wrote to memory of 540	8	decrypted_mXiTDRFpPk.exe	89
PID 8 wrote to memory of 540	8	decrypted_mXiTDRFpPk.exe	89

C:\Users\Admin\AppData\Local\Temp\cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe
"C:\Users\Admin\AppData\Local\Temp\cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Users\Admin\AppData\Local\Temp\cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe
  "C:\Users\Admin\AppData\Local\Temp\cdacba6a70615a4aec0e2e3dba3769c4b3db879feac79b1f504d5691107d19daN.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\decrypted_mXiTDRFpPk.exe
    "C:\Users\Admin\AppData\Local\Temp\decrypted_mXiTDRFpPk.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
      4⤵
      Executes dropped EXE
      PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI16722\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\_bz2.pyd

Filesize
83KB

MD5
dd26ed92888de9c57660a7ad631bb916

SHA1
77d479d44d9e04f0a1355569332233459b69a154

SHA256
324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

SHA512
d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\_decimal.pyd

Filesize
251KB

MD5
cea3b419c7ca87140a157629c6dbd299

SHA1
7dbff775235b1937b150ae70302b3208833dc9be

SHA256
95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

SHA512
6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\_hashlib.pyd

Filesize
64KB

MD5
d19cb5ca144ae1fd29b6395b0225cf40

SHA1
5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

SHA256
f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

SHA512
9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\_lzma.pyd

Filesize
156KB

MD5
8cfbafe65d6e38dde8e2e8006b66bb3e

SHA1
cb63addd102e47c777d55753c00c29c547e2243c

SHA256
6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

SHA512
fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\_socket.pyd

Filesize
81KB

MD5
e43aed7d6a8bcd9ddfc59c2d1a2c4b02

SHA1
36f367f68fb9868412246725b604b27b5019d747

SHA256
2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

SHA512
d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\base_library.zip

Filesize
1.3MB

MD5
48ba559bf70c3ef963f86633530667d6

SHA1
e3319e3a70590767ad00290230d77158f8f8307e

SHA256
f8377aa03b7036e7735e2814452c1759ab7ceec3f8f8a202b697b4132809ce5e

SHA512
567a7bef4a7c7ff0890708c0e62d2af748b645c8b9071953873b0dd5aa789c42796860896a6b5e539651de9a2243338e2a5fb47743c30dfcde59b1787c4c1871

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\select.pyd

Filesize
30KB

MD5
79ce1ae3a23dff6ed5fc66e6416600cd

SHA1
6204374d99144b0a26fd1d61940ff4f0d17c2212

SHA256
678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

SHA512
a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI16722\unicodedata.pyd

Filesize
1.1MB

MD5
b848e259fabaf32b4b3c980a0a12488d

SHA1
da2e864e18521c86c7d8968db74bb2b28e4c23e2

SHA256
c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

SHA512
4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\decrypted_mXiTDRFpPk.exe

Filesize
79KB

MD5
21b1dce511570c3c148a0894b8a41c28

SHA1
79108802bdad7dffc03feddbad9fc13d44cf417d

SHA256
3a241870ddb2e3670324d3327d165d1bbbf58ebaef283491ef81c61b66ac780b

SHA512
f6f5fff5a1546f6b24ecc7f8cb6c575388ffeea3cd5a5788ba5f124cd626df46cfb0fec6472bdaba615422af4f3c7ba39d38c6fe3a87c4183002a387876cb4da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1194130065-3471212556-1656947724-1000\dad26c7fb34006d4b0a12cb26564d378_a53bb4ca-6113-48bb-9609-441860fdd0d7

Filesize
2KB

MD5
8de91c4f830956990012f9fd1269e490

SHA1
5396852c5a98d586d3970638bebf52ac4d7da6b9

SHA256
4b1f314ed0d2dd0aedd922297f2b16cce1d5716a24469b72a9e17ea43bc40433

SHA512
4c0ef84683613edb6196a43e2da73c58203e080cdee1c4119ad6b3823db137fec0628eb7fa8f34a7da93aa142a13b001168959d59cb425ae858372b5d7f2d555

Download Submit
memory/8-39-0x000000001B5A0000-0x000000001BA6E000-memory.dmp

Filesize
4.8MB

Download
memory/8-45-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download
memory/8-41-0x000000001BB30000-0x000000001BBCC000-memory.dmp

Filesize
624KB

Download
memory/8-42-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download
memory/8-40-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download
memory/8-43-0x00000000009C0000-0x00000000009C8000-memory.dmp

Filesize
32KB

Download
memory/8-44-0x000000001BC90000-0x000000001BCDC000-memory.dmp

Filesize
304KB

Download
memory/8-38-0x000000001AFA0000-0x000000001B046000-memory.dmp

Filesize
664KB

Download
memory/8-46-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download
memory/8-51-0x000000001EE40000-0x000000001EEA2000-memory.dmp

Filesize
392KB

Download
memory/8-52-0x00007FFE7E6F5000-0x00007FFE7E6F6000-memory.dmp

Filesize
4KB

Download
memory/8-53-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download
memory/8-54-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download
memory/8-73-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download
memory/8-37-0x00007FFE7E6F5000-0x00007FFE7E6F6000-memory.dmp

Filesize
4KB

Download
memory/8-79-0x00007FFE7E440000-0x00007FFE7EDE1000-memory.dmp

Filesize
9.6MB

Download