General
-
Target
8e23ac8eb73d1d3704b3512394e73131f8b3b3606fd980068e2e90078d5d7103
-
Size
80KB
-
Sample
241021-arnt1a1arl
-
MD5
85e79fa13d873aa857cc7e58828b8b91
-
SHA1
f96a4d9e4ee7cfcdafff95859abbcd806ed6dc1d
-
SHA256
8e23ac8eb73d1d3704b3512394e73131f8b3b3606fd980068e2e90078d5d7103
-
SHA512
0fc152673f40f814f40ef59208836e61fd3d51a5b8b60812ae1c9c5eb6838ce790d735e74cf47a0fe53bdbcef2c90b7a01ef890131ffcb5aeca465ea1168c289
-
SSDEEP
1536:dPvK/3zvzVQtCsscKvWnjzJxuOmb54vHTL6lm:diqCspTzVmb5uHv6lm
Behavioral task
behavioral1
Sample
8e23ac8eb73d1d3704b3512394e73131f8b3b3606fd980068e2e90078d5d7103.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8e23ac8eb73d1d3704b3512394e73131f8b3b3606fd980068e2e90078d5d7103.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
blacknet
HacKed
https://lovegunny.net/
BN[GnFquUJG-0548378]
-
antivm
false
-
elevate_uac
true
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
cde2f914e4cce7f13b2c1cec7b6da970
-
startup
false
-
usb_spread
true
Targets
-
-
Target
8e23ac8eb73d1d3704b3512394e73131f8b3b3606fd980068e2e90078d5d7103
-
Size
80KB
-
MD5
85e79fa13d873aa857cc7e58828b8b91
-
SHA1
f96a4d9e4ee7cfcdafff95859abbcd806ed6dc1d
-
SHA256
8e23ac8eb73d1d3704b3512394e73131f8b3b3606fd980068e2e90078d5d7103
-
SHA512
0fc152673f40f814f40ef59208836e61fd3d51a5b8b60812ae1c9c5eb6838ce790d735e74cf47a0fe53bdbcef2c90b7a01ef890131ffcb5aeca465ea1168c289
-
SSDEEP
1536:dPvK/3zvzVQtCsscKvWnjzJxuOmb54vHTL6lm:diqCspTzVmb5uHv6lm
Score10/10-
BlackNET payload
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1