Analysis
- max time kernel
47s - max time network
59s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
04/03/2024, 12:31
General
- Target D867A6939E03FF1CCF63605DDDEA632E.exe
- Size 195KB
- Sample240304-pp92saac5v
- SHA256 eecb4035c620f07749f4627e6c7243dd4053b4918c6d76e236374900d0dace3b
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET payload 1 IoCs
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Adds Run key to start application 2 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\D867A6939E03FF1CCF63605DDDEA632E.exe"C:\Users\Admin\AppData\Local\Temp\D867A6939E03FF1CCF63605DDDEA632E.exe"1⤵
- Adds Run key to start application
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
WindowsUpdate.exe
__PSScriptPolicyTest_dyvmgu4q.wsm.ps1
svchosts.exe
d0f230304e413b49f7b36faf47b3bc53_571594ad-b717-4cea-93ae-747ab327a92a
memory/1872-52-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-54-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-6-0x0000000000EA0000-0x0000000000EA8000-memory.dmp
memory/1872-7-0x000000001C060000-0x000000001C0AC000-memory.dmp
memory/1872-8-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-13-0x000000001D000000-0x000000001D062000-memory.dmp
memory/1872-14-0x00007FFC8D520000-0x00007FFC8DEC1000-memory.dmp
memory/1872-15-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-16-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-24-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-23-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-26-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-25-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-27-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-29-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-28-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-30-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-40-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-41-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-4-0x00007FFC8D520000-0x00007FFC8DEC1000-memory.dmp
memory/1872-42-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-43-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-44-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-50-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-51-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-47-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-0-0x000000001B3C0000-0x000000001B466000-memory.dmp
memory/1872-53-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-5-0x000000001BF00000-0x000000001BF9C000-memory.dmp
memory/1872-106-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-105-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-104-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-70-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-3-0x000000001B990000-0x000000001BE5E000-memory.dmp
memory/1872-102-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-74-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-101-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-100-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-76-0x0000000020870000-0x0000000020970000-memory.dmp
memory/1872-99-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-79-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-2-0x0000000000ED0000-0x0000000000EE0000-memory.dmp
memory/1872-98-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/1872-1-0x00007FFC8D520000-0x00007FFC8DEC1000-memory.dmp
memory/1872-80-0x0000000020DC0000-0x0000000020FC0000-memory.dmp
memory/2232-90-0x000002BB487E0000-0x000002BB48802000-memory.dmp
memory/2232-75-0x00007FFC89DC0000-0x00007FFC8A881000-memory.dmp
memory/2232-68-0x000002BB48860000-0x000002BB48870000-memory.dmp
memory/4468-97-0x00007FFC8D520000-0x00007FFC8DEC1000-memory.dmp
memory/4468-78-0x00007FFC8D520000-0x00007FFC8DEC1000-memory.dmp
memory/4468-103-0x0000000000C70000-0x0000000000C80000-memory.dmp
memory/4468-77-0x0000000000C70000-0x0000000000C80000-memory.dmp
memory/4492-91-0x0000000000D60000-0x0000000000D70000-memory.dmp
memory/4492-96-0x0000000000D60000-0x0000000000D70000-memory.dmp
memory/4492-55-0x0000000000D60000-0x0000000000D70000-memory.dmp
memory/4492-73-0x00007FFC8D520000-0x00007FFC8DEC1000-memory.dmp
memory/4492-60-0x00007FFC8D520000-0x00007FFC8DEC1000-memory.dmp