Analysis
- max time kernel
149s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/10/2024, 00:35
General
- Target 69e06e55c9c44e8f775623a1979ea8f6398bf19ba803b1ff20eaa4f480779092N.exe
- Size 80KB
- Sample241014-axnfestflf
- SHA256 69e06e55c9c44e8f775623a1979ea8f6398bf19ba803b1ff20eaa4f480779092
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69e06e55c9c44e8f775623a1979ea8f6398bf19ba803b1ff20eaa4f480779092N.exe"C:\Users\Admin\AppData\Local\Temp\69e06e55c9c44e8f775623a1979ea8f6398bf19ba803b1ff20eaa4f480779092N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_btky0tmm.gwx.ps1
memory/212-21-0x00007FFF14C33000-0x00007FFF14C35000-memory.dmp
memory/212-27-0x0000015CC21F0000-0x0000015CC2212000-memory.dmp
memory/212-18-0x0000015CC2010000-0x0000015CC2020000-memory.dmp
memory/212-19-0x0000015CC2010000-0x0000015CC2020000-memory.dmp
memory/3008-16-0x00007FFF17CF5000-0x00007FFF17CF6000-memory.dmp
memory/3008-4-0x000000001BDE0000-0x000000001BE7C000-memory.dmp
memory/3008-7-0x000000001BF40000-0x000000001BF8C000-memory.dmp
memory/3008-8-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-9-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-10-0x000000001F440000-0x000000001F4A2000-memory.dmp
memory/3008-11-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-12-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-13-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-14-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-15-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-0-0x00007FFF17CF5000-0x00007FFF17CF6000-memory.dmp
memory/3008-17-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-5-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-20-0x0000000020180000-0x0000000020280000-memory.dmp
memory/3008-6-0x0000000000C70000-0x0000000000C78000-memory.dmp
memory/3008-2-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-3-0x000000001B820000-0x000000001BCEE000-memory.dmp
memory/3008-1-0x000000001B2A0000-0x000000001B346000-memory.dmp
memory/3008-35-0x0000000020180000-0x0000000020280000-memory.dmp
memory/3008-36-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-34-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-37-0x0000000020180000-0x0000000020280000-memory.dmp
memory/3008-38-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-39-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-40-0x00007FFF17A40000-0x00007FFF183E1000-memory.dmp
memory/3008-41-0x0000000020180000-0x0000000020280000-memory.dmp
memory/3008-42-0x0000000020180000-0x0000000020280000-memory.dmp
memory/3008-43-0x0000000020180000-0x0000000020280000-memory.dmp