F-Secure BlackEnergy 2014

BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.

BlackEnergy has gathered information about local network connections using netstat.

BlackEnergy injects its DLL component into svchost.exe.

BlackEnergy has gathered a process list by using Tasklist.exe.

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.

BlackEnergy communicates with its C2 server over HTTP.

BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.

BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.

One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.

BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.

BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.

BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.

One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.