Analysis

  • max time kernel
    5s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2024 20:53

General

  • Target

    d4e4cf8c41bb1577b18afd03749b5ea4b575e24051714e55a97c008ddc678dd7N.exe

  • Size

    70KB

  • MD5

    653f8b08a619a7dcb179de3411735320

  • SHA1

    8d5e8d215e7f78d5a2f9a63b78f6e4bc71133db0

  • SHA256

    d4e4cf8c41bb1577b18afd03749b5ea4b575e24051714e55a97c008ddc678dd7

  • SHA512

    680f179aae9f52d5a8880766713298e3bcde96a16a06ef9b0b1b45d3d7fda085636c3f0e656b359d65f7729f52f6b08d40d5dbc14476efb326be9ce70fab4b82

  • SSDEEP

    1536:gFTnqpKxynVBGeifCSzTPb542HkLbvJfxa:gFTQGeifrvb59H+bvJ5a

Malware Config

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • BlackNET payload 1 IoCs
  • Blacknet family
  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4e4cf8c41bb1577b18afd03749b5ea4b575e24051714e55a97c008ddc678dd7N.exe
    "C:\Users\Admin\AppData\Local\Temp\d4e4cf8c41bb1577b18afd03749b5ea4b575e24051714e55a97c008ddc678dd7N.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
      2⤵
      • Executes dropped EXE
      PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

    Filesize

    70KB

    MD5

    653f8b08a619a7dcb179de3411735320

    SHA1

    8d5e8d215e7f78d5a2f9a63b78f6e4bc71133db0

    SHA256

    d4e4cf8c41bb1577b18afd03749b5ea4b575e24051714e55a97c008ddc678dd7

    SHA512

    680f179aae9f52d5a8880766713298e3bcde96a16a06ef9b0b1b45d3d7fda085636c3f0e656b359d65f7729f52f6b08d40d5dbc14476efb326be9ce70fab4b82

  • memory/2444-10-0x000000001F5C0000-0x000000001F622000-memory.dmp

    Filesize

    392KB

  • memory/2444-36-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-9-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-4-0x000000001C670000-0x000000001C70C000-memory.dmp

    Filesize

    624KB

  • memory/2444-5-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-6-0x00000000012C0000-0x00000000012C8000-memory.dmp

    Filesize

    32KB

  • memory/2444-7-0x000000001C770000-0x000000001C7BC000-memory.dmp

    Filesize

    304KB

  • memory/2444-8-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-3-0x000000001C100000-0x000000001C5CE000-memory.dmp

    Filesize

    4.8MB

  • memory/2444-2-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-14-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-13-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-15-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-1-0x000000001BB80000-0x000000001BC26000-memory.dmp

    Filesize

    664KB

  • memory/2444-25-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-29-0x00007FFF4BDB5000-0x00007FFF4BDB6000-memory.dmp

    Filesize

    4KB

  • memory/2444-30-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2444-0-0x00007FFF4BDB5000-0x00007FFF4BDB6000-memory.dmp

    Filesize

    4KB

  • memory/2444-35-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-31-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-33-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-32-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-37-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-38-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-39-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-40-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-41-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-42-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-43-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-44-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-45-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-46-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-47-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-48-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-49-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB

  • memory/2876-50-0x00007FFF4BB00000-0x00007FFF4C4A1000-memory.dmp

    Filesize

    9.6MB