Analysis
- max time kernel
31s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
14/03/2024, 00:30
General
- Target c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e.exe
- Size 75KB
- Sample240314-atfleagc79
- SHA256 c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 51 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e.exe"C:\Users\Admin\AppData\Local\Temp\c14e74f1d39c962a0015521019131b3df3d48ebb44996c83c1569d3ad189e68e.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1948-0-0x000000001BC90000-0x000000001BD36000-memory.dmp
memory/1948-1-0x00007FFD55550000-0x00007FFD55EF1000-memory.dmp
memory/1948-2-0x000000001C210000-0x000000001C6DE000-memory.dmp
memory/1948-3-0x00007FFD55550000-0x00007FFD55EF1000-memory.dmp
memory/1948-4-0x000000001C820000-0x000000001C8BC000-memory.dmp
memory/1948-5-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/1948-6-0x000000001BC50000-0x000000001BC58000-memory.dmp
memory/1948-7-0x000000001C980000-0x000000001C9CC000-memory.dmp
memory/1948-8-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/1948-9-0x000000001F7E0000-0x000000001F842000-memory.dmp
memory/1948-10-0x00007FFD55550000-0x00007FFD55EF1000-memory.dmp
memory/1948-11-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/1948-12-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/1948-13-0x00007FFD55550000-0x00007FFD55EF1000-memory.dmp
memory/1948-14-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/1948-15-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/1948-16-0x00000000016A0000-0x00000000016B0000-memory.dmp
memory/1948-17-0x00000000016A0000-0x00000000016B0000-memory.dmp