Analysis
- max time kernel
119s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/10/2024, 02:21
General
- Target 731fff929418b133afc76e5981f9b0a6d9c7917c6bd42bdbd696c3a0a2ac5bf8N.exe
- Size 80KB
- Sample241014-cta22awdka
- SHA256 731fff929418b133afc76e5981f9b0a6d9c7917c6bd42bdbd696c3a0a2ac5bf8
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\731fff929418b133afc76e5981f9b0a6d9c7917c6bd42bdbd696c3a0a2ac5bf8N.exe"C:\Users\Admin\AppData\Local\Temp\731fff929418b133afc76e5981f9b0a6d9c7917c6bd42bdbd696c3a0a2ac5bf8N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_dkvthtvt.2ry.ps1
memory/2788-11-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-41-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-3-0x000000001B6C0000-0x000000001BB8E000-memory.dmp
memory/2788-4-0x000000001BC70000-0x000000001BD0C000-memory.dmp
memory/2788-5-0x0000000000B10000-0x0000000000B18000-memory.dmp
memory/2788-6-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-7-0x000000001BDD0000-0x000000001BE1C000-memory.dmp
memory/2788-8-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-9-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-10-0x000000001EF80000-0x000000001EFE2000-memory.dmp
memory/2788-0-0x00007FFB07B25000-0x00007FFB07B26000-memory.dmp
memory/2788-12-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-13-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-14-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-16-0x00007FFB07B25000-0x00007FFB07B26000-memory.dmp
memory/2788-17-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-15-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-1-0x000000001B140000-0x000000001B1E6000-memory.dmp
memory/2788-53-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/2788-19-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-2-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-52-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/2788-18-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-51-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/2788-33-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-34-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-35-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-50-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/2788-39-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-40-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-42-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/2788-49-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-44-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/2788-43-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-45-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-46-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/2788-47-0x00007FFB07870000-0x00007FFB08211000-memory.dmp
memory/2788-48-0x000000001C920000-0x000000001CA20000-memory.dmp
memory/4160-30-0x000001799B410000-0x000001799B432000-memory.dmp
memory/4160-38-0x00007FFB047D0000-0x00007FFB05291000-memory.dmp
memory/4160-32-0x00007FFB047D0000-0x00007FFB05291000-memory.dmp
memory/4160-31-0x00007FFB047D0000-0x00007FFB05291000-memory.dmp
memory/4160-20-0x00007FFB047D3000-0x00007FFB047D5000-memory.dmp