blacknet | 2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbb

Analysis

max time kernel
24s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
04-11-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
Size

10.0MB
MD5

4fbba071325c9b47f7b39ee15c2feb00
SHA1

84df9706705d3c0229e0c9aeec662db2770132dd
SHA256

2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbb
SHA512

54e67f7c5107386fdbcdc2691499e77f6ede405629687da5e8d70ed77426bbd6ba5208e2e945755030e5e5a0cc33402431c9b50f837e953e5c8d127a92a5f163
SSDEEP

196608:iCjV2NBODPzMsVerPYVnN/SMFmxA1HeT39Iig6Tet4Q4G/NsIdyzWdAMYI93:3V2fugPYVnNSMF1+TtIi1S1NsIUzWdAQ

Score

10^/10

blacknet persistence trojan

Malware Config

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023b7c-47.dat	family_blacknet

Blacknet family
blacknet

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral2/files/0x000b000000023b7c-47.dat	disable_win_def

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	decrypted_executable.exe

Executes dropped EXE 2 IoCs

pid	Process
2216	decrypted_executable.exe
1752	WindowsUpdate.exe

Loads dropped DLL 8 IoCs

pid	Process
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\decrypted_executable.exe"	decrypted_executable.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe"	decrypted_executable.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\35dcbc7eb742dd4f1edfbccf7826c724 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe"	WindowsUpdate.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x000a000000023b92-36.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
2216	decrypted_executable.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe
1752	WindowsUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	decrypted_executable.exe
Token: SeDebugPrivilege	1752	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 3836	912	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe	86
PID 912 wrote to memory of 3836	912	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe	86
PID 3836 wrote to memory of 2216	3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe	89
PID 3836 wrote to memory of 2216	3836	2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe	89
PID 2216 wrote to memory of 1752	2216	decrypted_executable.exe	97
PID 2216 wrote to memory of 1752	2216	decrypted_executable.exe	97

C:\Users\Admin\AppData\Local\Temp\2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
"C:\Users\Admin\AppData\Local\Temp\2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Users\Admin\AppData\Local\Temp\2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe
  "C:\Users\Admin\AppData\Local\Temp\2d513ec010655f8298949ef600d05761898ba9403574190c4ae29c71b8f18cbbN.exe"
  2⤵
  - Checks computer location settings
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe
    "C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
      "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI9122\VCRUNTIME140.dll

Filesize
116KB

MD5
be8dbe2dc77ebe7f88f910c61aec691a

SHA1
a19f08bb2b1c1de5bb61daf9f2304531321e0e40

SHA256
4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

SHA512
0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\_bz2.pyd

Filesize
83KB

MD5
dd26ed92888de9c57660a7ad631bb916

SHA1
77d479d44d9e04f0a1355569332233459b69a154

SHA256
324268786921ec940cbd4b5e2f71dafd08e578a12e373a715658527e5b211697

SHA512
d693367565005c1b87823e781dc5925146512182c8d8a3a2201e712c88df1c0e66e65ecaec9af22037f0a8f8b3fb3f511ea47cfd5774651d71673fab612d2897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\_cffi_backend.cp312-win_amd64.pyd

Filesize
175KB

MD5
d8caf1c098db12b2eba8edae51f31c10

SHA1
e533ac6c614d95c09082ae951b3b685daca29a8f

SHA256
364208a97336f577d99bbaaed6d2cf8a4a24d6693b323de4665f75a964ca041d

SHA512
77e36f4fb44374b7c58a9005a1d7dfeb3214eabb90786e8a7c6593b5b1c7a305d6aa446be7a06ae0ff38f2bedea68cacb39053b7b7ec297bff3571b3922fd938

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\_decimal.pyd

Filesize
251KB

MD5
cea3b419c7ca87140a157629c6dbd299

SHA1
7dbff775235b1937b150ae70302b3208833dc9be

SHA256
95b9850e6fb335b235589dd1348e007507c6b28e332c9abb111f2a0035c358e5

SHA512
6e3a6781c0f05bb5182073cca1e69b6df55f05ff7cdcea394bacf50f88605e2241b7387f1d8ba9f40a96832d04f55edb80003f0cf1e537a26f99408ee9312f5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\_hashlib.pyd

Filesize
64KB

MD5
d19cb5ca144ae1fd29b6395b0225cf40

SHA1
5b9ec6e656261ce179dfcfd5c6a3cfe07c2dfeb4

SHA256
f95ec2562a3c70fb1a6e44d72f4223ce3c7a0f0038159d09dce629f59591d5aa

SHA512
9ac3a8a4dbdb09be3760e7ccb11269f82a47b24c03d10d289bcdded9a43e57d3cd656f8d060d66b810382ecac3a62f101f83ea626b58cd0b5a3cca25b67b1519

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\_lzma.pyd

Filesize
156KB

MD5
8cfbafe65d6e38dde8e2e8006b66bb3e

SHA1
cb63addd102e47c777d55753c00c29c547e2243c

SHA256
6d548db0ab73291f82cf0f4ca9ec0c81460185319c8965e829faeacae19444ff

SHA512
fa021615d5c080aadcd5b84fd221900054eb763a7af8638f70cf6cd49bd92773074f1ac6884f3ce1d8a15d59439f554381377faee4842ed5beb13ff3e1b510f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\_socket.pyd

Filesize
81KB

MD5
e43aed7d6a8bcd9ddfc59c2d1a2c4b02

SHA1
36f367f68fb9868412246725b604b27b5019d747

SHA256
2c2a6a6ba360e38f0c2b5a53b4626f833a3111844d95615ebf35be0e76b1ef7a

SHA512
d92e26eb88db891de389a464f850a8da0a39af8a4d86d9894768cb97182b8351817ce14fe1eb8301b18b80d1d5d8876a48ba66eb7b874c7c3d7b009fcdbc8c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\base_library.zip

Filesize
1.3MB

MD5
48ba559bf70c3ef963f86633530667d6

SHA1
e3319e3a70590767ad00290230d77158f8f8307e

SHA256
f8377aa03b7036e7735e2814452c1759ab7ceec3f8f8a202b697b4132809ce5e

SHA512
567a7bef4a7c7ff0890708c0e62d2af748b645c8b9071953873b0dd5aa789c42796860896a6b5e539651de9a2243338e2a5fb47743c30dfcde59b1787c4c1871

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\cryptography\hazmat\bindings\_rust.pyd

Filesize
7.6MB

MD5
b98d491ead30f30e61bc3e865ab72f18

SHA1
db165369b7f2ae513b51c4f3def9ea2668268221

SHA256
35d5aeb890b99e6bae3e6b863313fbc8a1a554acbcd416fe901b1e1ae2993c98

SHA512
044c9c39bddb13020ed865d3aa30926460ae6ded5fdea59eca2b1cf6a4ded55728d883f19ee0749f95a4d93f66e04fcc62bc3be67119c4ccabd17b003cf5f3c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\libcrypto-3.dll

Filesize
5.0MB

MD5
e547cf6d296a88f5b1c352c116df7c0c

SHA1
cafa14e0367f7c13ad140fd556f10f320a039783

SHA256
05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de

SHA512
9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\python3.dll

Filesize
66KB

MD5
8dbe9bbf7118f4862e02cd2aaf43f1ab

SHA1
935bc8c5cea4502d0facf0c49c5f2b9c138608ed

SHA256
29f173e0147390a99f541ba0c0231fdd7dfbca84d0e2e561ef352bf1ec72f5db

SHA512
938f8387dcc356012ac4a952d371664700b110f7111fcc24f5df7d79791ae95bad0dbaf77d2d6c86c820bfd48a6bdbe8858b7e7ae1a77df88e596556c7135ed4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\python312.dll

Filesize
6.6MB

MD5
cae8fa4e7cb32da83acf655c2c39d9e1

SHA1
7a0055588a2d232be8c56791642cb0f5abbc71f8

SHA256
8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93

SHA512
db2190da2c35bceed0ef91d7553ff0dea442286490145c3d0e89db59ba1299b0851e601cc324b5f7fd026414fc73755e8eff2ef5fb5eeb1c54a9e13e7c66dd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\select.pyd

Filesize
30KB

MD5
79ce1ae3a23dff6ed5fc66e6416600cd

SHA1
6204374d99144b0a26fd1d61940ff4f0d17c2212

SHA256
678e09ad44be42fa9bc9c7a18c25dbe995a59b6c36a13eecc09c0f02a647b6f0

SHA512
a4e48696788798a7d061c0ef620d40187850741c2bec357db0e37a2dd94d3a50f9f55ba75dc4d95e50946cbab78b84ba1fc42d51fd498640a231321566613daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI9122\unicodedata.pyd

Filesize
1.1MB

MD5
b848e259fabaf32b4b3c980a0a12488d

SHA1
da2e864e18521c86c7d8968db74bb2b28e4c23e2

SHA256
c65073b65f107e471c9be3c699fb11f774e9a07581f41229582f7b2154b6fc3c

SHA512
4c6953504d1401fe0c74435bceebc5ec7bf8991fd42b659867a3529cee5cc64da54f1ab404e88160e747887a7409098f1a85a546bc40f12f0dde0025408f9e27

Download Submit
C:\Users\Admin\AppData\Local\Temp\decrypted_executable.exe

Filesize
79KB

MD5
21b1dce511570c3c148a0894b8a41c28

SHA1
79108802bdad7dffc03feddbad9fc13d44cf417d

SHA256
3a241870ddb2e3670324d3327d165d1bbbf58ebaef283491ef81c61b66ac780b

SHA512
f6f5fff5a1546f6b24ecc7f8cb6c575388ffeea3cd5a5788ba5f124cd626df46cfb0fec6472bdaba615422af4f3c7ba39d38c6fe3a87c4183002a387876cb4da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3756129449-3121373848-4276368241-1000\dff62b7dd57ff8f25835f8ca5996ee93_a63d6fdc-08cb-4232-ab51-76cafdcb4d96

Filesize
2KB

MD5
8de91c4f830956990012f9fd1269e490

SHA1
5396852c5a98d586d3970638bebf52ac4d7da6b9

SHA256
4b1f314ed0d2dd0aedd922297f2b16cce1d5716a24469b72a9e17ea43bc40433

SHA512
4c0ef84683613edb6196a43e2da73c58203e080cdee1c4119ad6b3823db137fec0628eb7fa8f34a7da93aa142a13b001168959d59cb425ae858372b5d7f2d555

Download Submit
memory/2216-67-0x000000001C2F0000-0x000000001C33C000-memory.dmp

Filesize
304KB

Download
memory/2216-56-0x000000001BBD0000-0x000000001C09E000-memory.dmp

Filesize
4.8MB

Download
memory/2216-57-0x000000001C190000-0x000000001C22C000-memory.dmp

Filesize
624KB

Download
memory/2216-59-0x000000001B670000-0x000000001B678000-memory.dmp

Filesize
32KB

Download
memory/2216-58-0x00007FF991720000-0x00007FF9920C1000-memory.dmp

Filesize
9.6MB

Download
memory/2216-54-0x00007FF9919D5000-0x00007FF9919D6000-memory.dmp

Filesize
4KB

Download
memory/2216-68-0x00007FF991720000-0x00007FF9920C1000-memory.dmp

Filesize
9.6MB

Download
memory/2216-73-0x000000001F4A0000-0x000000001F502000-memory.dmp

Filesize
392KB

Download
memory/2216-74-0x00007FF9919D5000-0x00007FF9919D6000-memory.dmp

Filesize
4KB

Download
memory/2216-75-0x00007FF991720000-0x00007FF9920C1000-memory.dmp

Filesize
9.6MB

Download
memory/2216-95-0x00007FF991720000-0x00007FF9920C1000-memory.dmp

Filesize
9.6MB

Download
memory/2216-55-0x000000001B5B0000-0x000000001B656000-memory.dmp

Filesize
664KB

Download