Analysis
- max time kernel
150s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
10/10/2024, 23:22
General
- Target 821b89cff2bee107acb9565ce0e4801a0c3cd7e666e13bd7e0d11d99348ae2a1.exe
- Size 80KB
- Sample241010-3ck4sascld
- SHA256 821b89cff2bee107acb9565ce0e4801a0c3cd7e666e13bd7e0d11d99348ae2a1
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\821b89cff2bee107acb9565ce0e4801a0c3cd7e666e13bd7e0d11d99348ae2a1.exe"C:\Users\Admin\AppData\Local\Temp\821b89cff2bee107acb9565ce0e4801a0c3cd7e666e13bd7e0d11d99348ae2a1.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_v21nb2y2.fzw.ps1
memory/3648-82-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-60-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-3-0x000000001BFD0000-0x000000001C49E000-memory.dmp
memory/3648-4-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-5-0x000000001C580000-0x000000001C61C000-memory.dmp
memory/3648-6-0x0000000001410000-0x0000000001418000-memory.dmp
memory/3648-7-0x000000001C6E0000-0x000000001C72C000-memory.dmp
memory/3648-8-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-59-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-10-0x000000001D360000-0x000000001D3C2000-memory.dmp
memory/3648-11-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-12-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-13-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-14-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-15-0x00007FFDBF6E5000-0x00007FFDBF6E6000-memory.dmp
memory/3648-16-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-106-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-105-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-1-0x000000001BA50000-0x000000001BAF6000-memory.dmp
memory/3648-31-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-103-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-29-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-104-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-101-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-35-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-36-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-37-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-40-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-39-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-38-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-41-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-42-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-58-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-44-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-45-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-46-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-47-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-48-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-49-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-50-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-52-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-51-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-53-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-54-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-55-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-56-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-43-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-2-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-9-0x00007FFDBF430000-0x00007FFDBFDD1000-memory.dmp
memory/3648-57-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-61-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-62-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-64-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-63-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-65-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-66-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-68-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-67-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-69-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-71-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-70-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-73-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-72-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-74-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-75-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-77-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-76-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-79-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-78-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-81-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-80-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-0-0x00007FFDBF6E5000-0x00007FFDBF6E6000-memory.dmp
memory/3648-83-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-84-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-85-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-86-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-87-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-89-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-88-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-91-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-90-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-93-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-92-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-95-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-94-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-96-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-97-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-98-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-99-0x00000000014C0000-0x00000000014D0000-memory.dmp
memory/3648-100-0x0000000020530000-0x0000000020630000-memory.dmp
memory/3648-102-0x0000000020530000-0x0000000020630000-memory.dmp
memory/5080-34-0x00007FFDBC410000-0x00007FFDBCED1000-memory.dmp
memory/5080-28-0x00007FFDBC410000-0x00007FFDBCED1000-memory.dmp
memory/5080-30-0x000002344B180000-0x000002344B190000-memory.dmp
memory/5080-27-0x000002344B290000-0x000002344B2B2000-memory.dmp
memory/5080-17-0x00007FFDBC413000-0x00007FFDBC415000-memory.dmp