Analysis
- max time kernel
120s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
14/10/2024, 16:23
General
- Target eeed3633f28210df33d4bce4fe2990c3210fb92f6c55d44e591ce9d86aff6cb9N.exe
- Size 80KB
- Sample241014-tv2d2syarm
- SHA256 eeed3633f28210df33d4bce4fe2990c3210fb92f6c55d44e591ce9d86aff6cb9
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeed3633f28210df33d4bce4fe2990c3210fb92f6c55d44e591ce9d86aff6cb9N.exe"C:\Users\Admin\AppData\Local\Temp\eeed3633f28210df33d4bce4fe2990c3210fb92f6c55d44e591ce9d86aff6cb9N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_2ib5xw45.fnd.ps1
memory/2108-82-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-61-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-3-0x000000001BDB0000-0x000000001C27E000-memory.dmp
memory/2108-4-0x000000001C340000-0x000000001C3DC000-memory.dmp
memory/2108-5-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-6-0x00000000010C0000-0x00000000010C8000-memory.dmp
memory/2108-7-0x000000001C4A0000-0x000000001C4EC000-memory.dmp
memory/2108-8-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-58-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-10-0x000000001F690000-0x000000001F6F2000-memory.dmp
memory/2108-11-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-12-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-13-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-14-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-15-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-16-0x00007FF815085000-0x00007FF815086000-memory.dmp
memory/2108-17-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-18-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-19-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-105-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-1-0x000000001B7A0000-0x000000001B846000-memory.dmp
memory/2108-106-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-103-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-32-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-104-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-34-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-35-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-102-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-40-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-39-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-41-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-43-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-56-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-45-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-44-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-46-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-47-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-48-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-49-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-50-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-51-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-52-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-53-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-54-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-55-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-57-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-42-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-2-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-9-0x00007FF814DD0000-0x00007FF815771000-memory.dmp
memory/2108-59-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-60-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-63-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-62-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-64-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-66-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-65-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-67-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-69-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-68-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-71-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-70-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-73-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-72-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-74-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-75-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-77-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-76-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-79-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-78-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-81-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-80-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-0-0x00007FF815085000-0x00007FF815086000-memory.dmp
memory/2108-84-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-83-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-86-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-85-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-87-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-88-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-90-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-89-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-91-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-92-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-93-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-94-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-95-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-96-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-97-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-98-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-99-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2108-101-0x000000001D530000-0x000000001D630000-memory.dmp
memory/2108-100-0x00000000013D0000-0x00000000013E0000-memory.dmp
memory/2456-38-0x00007FF8114B0000-0x00007FF811F71000-memory.dmp
memory/2456-33-0x0000022677840000-0x0000022677862000-memory.dmp
memory/2456-31-0x00007FF8114B0000-0x00007FF811F71000-memory.dmp
memory/2456-30-0x00007FF8114B0000-0x00007FF811F71000-memory.dmp
memory/2456-20-0x00007FF8114B3000-0x00007FF8114B5000-memory.dmp