Overview

overview

10

Static

static

10

WinlockerB...V5.exe

windows10-2004-x64

10

WinlockerB...V5.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    WinlockerBuilderV5.exe
  • Size 11.0MB
  • Sample260607-nrpcesd12l
  • SHA256 51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
blacknetdarkcometbotguest16discoverypersistencerattrojanupx

Malware Config

Extracted

Family

  • blacknet

Version

  • v3.6.0 Public

Botnet

  • Bot

C2

  • http://f0483357.xsph.ru/

Mutex

  • BN[PHfunXGI-6235724]

Attributes
  • antivm

    true

  • elevate_uac

    false

  • install_name

    jusched.exe

  • splitter

    |BN|

  • start_name

    a5b002eacf54590ec8401ff6d3f920ee

  • startup

    true

  • usb_spread

    true

Extracted

Family

  • darkcomet

Botnet

  • Guest16

C2

  • gameservice.ddns.net:4320

Mutex

  • DC_MUTEX-WBUNVXD

Attributes
  • InstallPath

    AudioDriver\taskhost.exe

  • gencode

    EWSsWwgyJrUD

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    AudioDriver

rc4.plain

Targets

    • Target
      WinlockerBuilderV5.exe
    • Size 11.0MB
    • SHA256 51c45fb238881bd25fd7435d8b8e44eee9cc56887a56a7e5f5bdef8ec8392465
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    guest16discoveryblacknetdarkcometpersistencerattrojanbotupx

    • BlackNET payload

    • Family: BlackNET

      BlackNET is an open source remote access tool written in VB.NET.

      trojanblacknet

    • Family: Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks