Analysis
- max time kernel
45s - max time network
135s - platform
windows10_x64 - resource
win10-en - submitted
07/09/2021, 06:11
General
- Target d2f76bb2a6a2606f5ddccdbfc50661419709ff93c5c70367e9ccbc1a93db24d0.exe
- Size 86KB
- Sample210907-gxpf2sfcdk
- SHA256 d2f76bb2a6a2606f5ddccdbfc50661419709ff93c5c70367e9ccbc1a93db24d0
Score
10/10
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2f76bb2a6a2606f5ddccdbfc50661419709ff93c5c70367e9ccbc1a93db24d0.exe"C:\Users\Admin\AppData\Local\Temp\d2f76bb2a6a2606f5ddccdbfc50661419709ff93c5c70367e9ccbc1a93db24d0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4640-115-0x0000000001350000-0x0000000001352000-memory.dmp
memory/4640-116-0x0000000001354000-0x0000000001355000-memory.dmp
memory/4640-117-0x0000000001356000-0x0000000001357000-memory.dmp
memory/4640-118-0x0000000001359000-0x000000000135A000-memory.dmp
memory/4640-119-0x000000000135A000-0x000000000135F000-memory.dmp