blacknet | 47f20e39f51c71bbc24e7bf28496c859cf3e4e9dc81cc439f177956aba6d32a3

General

Target

383415F1B59A5B44074655ECF23D806B.exe
Size

99KB
MD5

383415f1b59a5b44074655ecf23d806b
SHA1

febd2f81bfb9debb631160673f6bf5718cae0f37
SHA256

47f20e39f51c71bbc24e7bf28496c859cf3e4e9dc81cc439f177956aba6d32a3
SHA512

62a081357e5ef2b1cd8cb3d3062624a8192542fba3f1959a9a5ab17db0fbb5f2687244a99abb31ee9631c19d4134f3d1e5bc313f1c97de10ff1c4c13e028ab17
SSDEEP

1536:09FUuRWzwFfsSMBdvueI5Xq8ZGAHEKJusRebSTr2qPQ2TYB+ezwRYx3beV5EKQLa:/MlDZGIuLS3TYB+eztx3be/EKyyFfai

Score

10^/10

blacknet hacked discovery persistence trojan

Malware Config

Extracted

Family

blacknet

Version

v3.7.0 Public

Botnet

HacKed

C2

http://148.72.170.231:4444/BNET

Mutex

BN[]

Attributes

antivm
false
elevate_uac
false
install_name
WindowsUpdate.exe
splitter
|BN|
start_name
e162b1333458a713bc6916cc8ac4110c
startup
false
usb_spread
false

Signatures

BlackNET
BlackNET is an open source remote access tool written in VB.NET.
trojan blacknet

BlackNET payload 3 IoCs

resource	yara_rule
behavioral1/memory/2596-1-0x00000000011D0000-0x00000000011EE000-memory.dmp	family_blacknet
behavioral1/files/0x00070000000193b8-12.dat	family_blacknet
behavioral1/memory/2792-14-0x0000000000F10000-0x0000000000F2E000-memory.dmp	family_blacknet

Blacknet family
blacknet

Contains code to disable Windows Defender 3 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral1/memory/2596-1-0x00000000011D0000-0x00000000011EE000-memory.dmp	disable_win_def
behavioral1/files/0x00070000000193b8-12.dat	disable_win_def
behavioral1/memory/2792-14-0x0000000000F10000-0x0000000000F2E000-memory.dmp	disable_win_def

Executes dropped EXE 1 IoCs

pid	Process
2792	WindowsUpdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\e162b1333458a713bc6916cc8ac4110c = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\MyClient\\WindowsUpdate.exe"	383415F1B59A5B44074655ECF23D806B.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2768	PING.EXE
2176	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2768	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2596	383415F1B59A5B44074655ECF23D806B.exe
2792	WindowsUpdate.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	383415F1B59A5B44074655ECF23D806B.exe
Token: SeDebugPrivilege	2792	WindowsUpdate.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2596	383415F1B59A5B44074655ECF23D806B.exe
2596	383415F1B59A5B44074655ECF23D806B.exe
2792	WindowsUpdate.exe
2792	WindowsUpdate.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2176	2596	383415F1B59A5B44074655ECF23D806B.exe	31
PID 2596 wrote to memory of 2176	2596	383415F1B59A5B44074655ECF23D806B.exe	31
PID 2596 wrote to memory of 2176	2596	383415F1B59A5B44074655ECF23D806B.exe	31
PID 2596 wrote to memory of 2792	2596	383415F1B59A5B44074655ECF23D806B.exe	33
PID 2596 wrote to memory of 2792	2596	383415F1B59A5B44074655ECF23D806B.exe	33
PID 2596 wrote to memory of 2792	2596	383415F1B59A5B44074655ECF23D806B.exe	33
PID 2176 wrote to memory of 2768	2176	cmd.exe	34
PID 2176 wrote to memory of 2768	2176	cmd.exe	34
PID 2176 wrote to memory of 2768	2176	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\383415F1B59A5B44074655ECF23D806B.exe
"C:\Users\Admin\AppData\Local\Temp\383415F1B59A5B44074655ECF23D806B.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ping 1.1.1.1 -n 5 -w 5000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\383415F1B59A5B44074655ECF23D806B.exe"
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 5 -w 5000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2768
- C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe

Filesize
99KB

MD5
383415f1b59a5b44074655ecf23d806b

SHA1
febd2f81bfb9debb631160673f6bf5718cae0f37

SHA256
47f20e39f51c71bbc24e7bf28496c859cf3e4e9dc81cc439f177956aba6d32a3

SHA512
62a081357e5ef2b1cd8cb3d3062624a8192542fba3f1959a9a5ab17db0fbb5f2687244a99abb31ee9631c19d4134f3d1e5bc313f1c97de10ff1c4c13e028ab17

Download Submit
memory/2596-0-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp

Filesize
4KB

Download
memory/2596-1-0x00000000011D0000-0x00000000011EE000-memory.dmp

Filesize
120KB

Download
memory/2596-2-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2596-3-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2596-4-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2596-5-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2596-6-0x000007FEF5B13000-0x000007FEF5B14000-memory.dmp

Filesize
4KB

Download
memory/2596-7-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2596-15-0x000007FEF5B10000-0x000007FEF64FC000-memory.dmp

Filesize
9.9MB

Download
memory/2792-14-0x0000000000F10000-0x0000000000F2E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads