Analysis
- max time kernel
118s - max time network
107s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
11/10/2024, 08:31
General
- Target 049d88e7d5ebba8661c5e96bcc1c57cab39e9513f3979d167b897566244b5324N.exe
- Size 80KB
- Sample241011-ke8nrazarr
- SHA256 049d88e7d5ebba8661c5e96bcc1c57cab39e9513f3979d167b897566244b5324
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\049d88e7d5ebba8661c5e96bcc1c57cab39e9513f3979d167b897566244b5324N.exe"C:\Users\Admin\AppData\Local\Temp\049d88e7d5ebba8661c5e96bcc1c57cab39e9513f3979d167b897566244b5324N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_kf4hirv5.swm.ps1
memory/956-14-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-35-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-3-0x000000001B690000-0x000000001BB5E000-memory.dmp
memory/956-4-0x000000001BCB0000-0x000000001BD4C000-memory.dmp
memory/956-5-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-6-0x0000000000CC0000-0x0000000000CC8000-memory.dmp
memory/956-7-0x000000001BE10000-0x000000001BE5C000-memory.dmp
memory/956-8-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-9-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-10-0x000000001CA90000-0x000000001CAF2000-memory.dmp
memory/956-11-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-16-0x00007FFC5DDC5000-0x00007FFC5DDC6000-memory.dmp
memory/956-2-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-13-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-12-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-0-0x00007FFC5DDC5000-0x00007FFC5DDC6000-memory.dmp
memory/956-17-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-42-0x000000001FB60000-0x000000001FC60000-memory.dmp
memory/956-41-0x000000001FB60000-0x000000001FC60000-memory.dmp
memory/956-1-0x0000000000C00000-0x0000000000CA6000-memory.dmp
memory/956-40-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-31-0x000000001FB60000-0x000000001FC60000-memory.dmp
memory/956-30-0x000000001FB60000-0x000000001FC60000-memory.dmp
memory/956-39-0x000000001FB60000-0x000000001FC60000-memory.dmp
memory/956-38-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-36-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/956-37-0x00007FFC5DB10000-0x00007FFC5E4B1000-memory.dmp
memory/4656-15-0x00007FFC5A973000-0x00007FFC5A975000-memory.dmp
memory/4656-34-0x00007FFC5A970000-0x00007FFC5B431000-memory.dmp
memory/4656-20-0x00007FFC5A970000-0x00007FFC5B431000-memory.dmp
memory/4656-19-0x00007FFC5A970000-0x00007FFC5B431000-memory.dmp
memory/4656-18-0x0000020D52E30000-0x0000020D52E52000-memory.dmp