Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
12/10/2024, 19:08
General
- Target 14d0e4f4c233605a858bbf6b8a2d72ad4a93bd974ad1753a5539510d67d74d9d.exe
- Size 80KB
- Sample241012-xteqfa1bmk
- SHA256 14d0e4f4c233605a858bbf6b8a2d72ad4a93bd974ad1753a5539510d67d74d9d
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14d0e4f4c233605a858bbf6b8a2d72ad4a93bd974ad1753a5539510d67d74d9d.exe"C:\Users\Admin\AppData\Local\Temp\14d0e4f4c233605a858bbf6b8a2d72ad4a93bd974ad1753a5539510d67d74d9d.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tfhxraza.23e.ps1
memory/4528-44-0x0000000001460000-0x0000000001470000-memory.dmp
memory/4528-17-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-3-0x000000001C000000-0x000000001C4CE000-memory.dmp
memory/4528-4-0x000000001C570000-0x000000001C60C000-memory.dmp
memory/4528-5-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-6-0x00000000012D0000-0x00000000012D8000-memory.dmp
memory/4528-7-0x000000001C700000-0x000000001C74C000-memory.dmp
memory/4528-8-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-9-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-10-0x000000001D2F0000-0x000000001D352000-memory.dmp
memory/4528-11-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-12-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-13-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-20-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-15-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-24-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-16-0x00007FF8E4595000-0x00007FF8E4596000-memory.dmp
memory/4528-18-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-55-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-23-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-54-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-53-0x0000000001460000-0x0000000001470000-memory.dmp
memory/4528-2-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-25-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-14-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-52-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-1-0x000000001BA00000-0x000000001BAA6000-memory.dmp
memory/4528-51-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-40-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-42-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-41-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-39-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-0-0x00007FF8E4595000-0x00007FF8E4596000-memory.dmp
memory/4528-43-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-45-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-46-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-47-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-48-0x00007FF8E42E0000-0x00007FF8E4C81000-memory.dmp
memory/4528-49-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4528-50-0x0000000020400000-0x0000000020500000-memory.dmp
memory/4628-36-0x000002AA71360000-0x000002AA71370000-memory.dmp
memory/4628-31-0x000002AA71A50000-0x000002AA71A72000-memory.dmp
memory/4628-21-0x000002AA71360000-0x000002AA71370000-memory.dmp
memory/4628-22-0x000002AA71360000-0x000002AA71370000-memory.dmp
memory/4628-19-0x00007FF8E11D3000-0x00007FF8E11D5000-memory.dmp