blacknet | fa3f7a4c1502f499a481b56f5e7c185876626e3d00110d84e09652f98b776aff

Resubmissions

27-11-2024 13:29

241127-qrb37svpcv 10

27-11-2024 09:27

241127-le54astrfj 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27-11-2024 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
Size

247KB
MD5

312e0a90fe8474691950d41e57bfb003
SHA1

f8185c7943c6e93b75c0cec34daf2eccd7db848b
SHA256

7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f
SHA512

511b9029002da76cceaa9fc2a47aebfe6a365f3588614094ec8bddaaad80305fe79ba45d9a1cb23ca0c1d1572eb5106073fac033b644df5e867a13db69e39678
SSDEEP

3072:FYl5q4euWjwNpbF3onQ7twT12Hd+d9nVap5Ty6dz6m:yTqgWcbF/7twTWm64

Score

10^/10

blacknet hacked persistence trojan

Malware Config

Extracted

Family

blacknet

Botnet

HacKed

https://xblackeyex.000webhostapp.com/blacknet/

Mutex

BN[SNqrYexG-0655563]

Attributes

antivm
false
elevate_uac
false
install_name
svchost.exe
splitter
|BN|
start_name
17d5d9a29524a220af2c5580f0145c42
startup
false
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 1 IoCs

Processes:

resource	yara_rule
behavioral15/files/0x00050000000195ca-10.dat	family_blacknet

Blacknet family
blacknet

Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid	Process
2812	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\17d5d9a29524a220af2c5580f0145c42 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\svchost.exe"	7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

svchost.exe

pid	Process
2812	svchost.exe
2812	svchost.exe
2812	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description	pid	Process
Token: SeDebugPrivilege	2812	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe

description	pid	Process	procid_target
PID 1620 wrote to memory of 2812	1620	7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe	31
PID 1620 wrote to memory of 2812	1620	7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe	31
PID 1620 wrote to memory of 2812	1620	7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe	31

C:\Users\Admin\AppData\Local\Temp\7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe
"C:\Users\Admin\AppData\Local\Temp\7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\svchost.exe

Filesize
247KB

MD5
312e0a90fe8474691950d41e57bfb003

SHA1
f8185c7943c6e93b75c0cec34daf2eccd7db848b

SHA256
7d6892645bc5ba581b2fff986b3e9371dd7298bab6aac890c99f80c8b1d78f0f

SHA512
511b9029002da76cceaa9fc2a47aebfe6a365f3588614094ec8bddaaad80305fe79ba45d9a1cb23ca0c1d1572eb5106073fac033b644df5e867a13db69e39678

Download Submit
memory/1620-0-0x000007FEF630E000-0x000007FEF630F000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/1620-2-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/1620-3-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/1620-4-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/1620-12-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/2812-11-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/2812-13-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download
memory/2812-14-0x000007FEF6050000-0x000007FEF69ED000-memory.dmp

Filesize
9.6MB

Download