Analysis
- max time kernel
149s - max time network
106s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
16/10/2024, 21:27
General
- Target 62730cb99573266ecf79c18fc34d0856aa0fd24a0ae0d0ccce6507f485264e14.exe
- Size 80KB
- Sample241016-1a2bwatepd
- SHA256 62730cb99573266ecf79c18fc34d0856aa0fd24a0ae0d0ccce6507f485264e14
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62730cb99573266ecf79c18fc34d0856aa0fd24a0ae0d0ccce6507f485264e14.exe"C:\Users\Admin\AppData\Local\Temp\62730cb99573266ecf79c18fc34d0856aa0fd24a0ae0d0ccce6507f485264e14.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_gigjlzpd.mv4.ps1
memory/644-75-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-50-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-3-0x000000001C0B0000-0x000000001C57E000-memory.dmp
memory/644-4-0x000000001C620000-0x000000001C6BC000-memory.dmp
memory/644-5-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-6-0x00000000013B0000-0x00000000013B8000-memory.dmp
memory/644-7-0x000000001C8D0000-0x000000001C91C000-memory.dmp
memory/644-8-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-9-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-10-0x000000001D970000-0x000000001D9D2000-memory.dmp
memory/644-11-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-12-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-14-0x00007FFAAC6E5000-0x00007FFAAC6E6000-memory.dmp
memory/644-13-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-15-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-16-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-17-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-56-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-97-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-1-0x000000001BB30000-0x000000001BBD6000-memory.dmp
memory/644-96-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-30-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-95-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-35-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-34-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-37-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-36-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-38-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-39-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-40-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-41-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-42-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-43-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-44-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-45-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-46-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-47-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-48-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-49-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-51-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-54-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-52-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-2-0x00007FFAAC430000-0x00007FFAACDD1000-memory.dmp
memory/644-53-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-94-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-55-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-57-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-58-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-60-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-59-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-61-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-62-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-64-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-63-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-66-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-65-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-68-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-67-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-69-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-70-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-72-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-71-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-74-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-73-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-76-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-0-0x00007FFAAC6E5000-0x00007FFAAC6E6000-memory.dmp
memory/644-78-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-77-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-79-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-81-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-80-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-83-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-82-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-84-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-86-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-85-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-88-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-87-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-89-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-90-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-91-0x0000000001470000-0x0000000001480000-memory.dmp
memory/644-92-0x00000000204D0000-0x00000000205D0000-memory.dmp
memory/644-93-0x0000000001470000-0x0000000001480000-memory.dmp
memory/4596-18-0x00007FFAA8573000-0x00007FFAA8575000-memory.dmp
memory/4596-33-0x00007FFAA8570000-0x00007FFAA9031000-memory.dmp
memory/4596-29-0x00007FFAA8570000-0x00007FFAA9031000-memory.dmp
memory/4596-28-0x0000020C249B0000-0x0000020C249D2000-memory.dmp