General
-
Target
1d356d96a08f667c283b0edd656cb1f50fe9e071cb35a4188618d3076784ebb0N
-
Size
80KB
-
Sample
241027-s96rmszell
-
MD5
a320960974f95b1038652eb4ea26d550
-
SHA1
0ec59c0841b993bc748c0ec33192ce1a4618854d
-
SHA256
1d356d96a08f667c283b0edd656cb1f50fe9e071cb35a4188618d3076784ebb0
-
SHA512
e27079c47d948ea3c880b3fda54bee32369f0e2744a1cea51ae894c62135bc31660f0686839869076f1616b485821ea254aa9ed0c932b82999add19bc9811af2
-
SSDEEP
1536:dPvK/3zvzVQtCsscKvWXjzJxuOmb54vHTL6lm:diqCspDzVmb5uHv6lm
Behavioral task
behavioral1
Sample
1d356d96a08f667c283b0edd656cb1f50fe9e071cb35a4188618d3076784ebb0N.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
1d356d96a08f667c283b0edd656cb1f50fe9e071cb35a4188618d3076784ebb0N.exe
Resource
win10v2004-20241007-en
Malware Config
Extracted
blacknet
HacKed
https://lovegunny.net/
BN[GnFquUJG-0548378]
-
antivm
false
-
elevate_uac
true
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
cde2f914e4cce7f13b2c1cec7b6da970
-
startup
false
-
usb_spread
true
Targets
-
-
Target
1d356d96a08f667c283b0edd656cb1f50fe9e071cb35a4188618d3076784ebb0N
-
Size
80KB
-
MD5
a320960974f95b1038652eb4ea26d550
-
SHA1
0ec59c0841b993bc748c0ec33192ce1a4618854d
-
SHA256
1d356d96a08f667c283b0edd656cb1f50fe9e071cb35a4188618d3076784ebb0
-
SHA512
e27079c47d948ea3c880b3fda54bee32369f0e2744a1cea51ae894c62135bc31660f0686839869076f1616b485821ea254aa9ed0c932b82999add19bc9811af2
-
SSDEEP
1536:dPvK/3zvzVQtCsscKvWXjzJxuOmb54vHTL6lm:diqCspDzVmb5uHv6lm
Score10/10-
BlackNET payload
-
Blacknet family
-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1