Analysis

  • max time kernel
    120s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 19:34

General

  • Target

    2f52602c0a401fb7ad25145c7f85cbada4c2eefa770aa6df65213106248a1903N.exe

  • Size

    80KB

  • MD5

    354e086ff47eda95da300f1923f798e0

  • SHA1

    519f78388ad553636f0cdac68e6fef183736ecf8

  • SHA256

    2f52602c0a401fb7ad25145c7f85cbada4c2eefa770aa6df65213106248a1903

  • SHA512

    37fadac5e0780ba7867561848969399cfacd64a5e73d680ce3e53a559e941c32dbc86f6a34aa98c557677a038e85386c901d9d27207cd9d43098a93144ee8a37

  • SSDEEP

    1536:QPvK/3zvzVJJicVLhilofshrjzJxuOmb54vHTL+lf:Qi5ikFSofwzVmb5uHv+lf

Score
10/10

Malware Config

Signatures

  • BlackNET

    BlackNET is an open source remote access tool written in VB.NET.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f52602c0a401fb7ad25145c7f85cbada4c2eefa770aa6df65213106248a1903N.exe
    "C:\Users\Admin\AppData\Local\Temp\2f52602c0a401fb7ad25145c7f85cbada4c2eefa770aa6df65213106248a1903N.exe"
    1⤵
    • Modifies Windows Defender Real-time Protection settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4240

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gdlmx2cv.odb.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/3812-58-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-80-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-2-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-3-0x000000001B660000-0x000000001BB2E000-memory.dmp

    Filesize

    4.8MB

  • memory/3812-4-0x000000001BBE0000-0x000000001BC7C000-memory.dmp

    Filesize

    624KB

  • memory/3812-5-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-6-0x0000000000870000-0x0000000000878000-memory.dmp

    Filesize

    32KB

  • memory/3812-7-0x000000001BD40000-0x000000001BD8C000-memory.dmp

    Filesize

    304KB

  • memory/3812-59-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-9-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-10-0x000000001C7C0000-0x000000001C822000-memory.dmp

    Filesize

    392KB

  • memory/3812-11-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-13-0x00007FF901C45000-0x00007FF901C46000-memory.dmp

    Filesize

    4KB

  • memory/3812-12-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-14-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-16-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-15-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-17-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-32-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-31-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-33-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-34-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-106-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-105-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-104-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-102-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-103-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-38-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-39-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-40-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-42-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-41-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-56-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-43-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-46-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-45-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-47-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-48-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-49-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-51-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-50-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-52-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-54-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-53-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-55-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-57-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-44-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-60-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-8-0x00007FF901990000-0x00007FF902331000-memory.dmp

    Filesize

    9.6MB

  • memory/3812-0-0x00007FF901C45000-0x00007FF901C46000-memory.dmp

    Filesize

    4KB

  • memory/3812-62-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-61-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-64-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-63-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-65-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-66-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-67-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-68-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-69-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-71-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-70-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-73-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-72-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-74-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-75-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-76-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-77-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-78-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-79-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-81-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-1-0x000000001B0E0000-0x000000001B186000-memory.dmp

    Filesize

    664KB

  • memory/3812-82-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-83-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-85-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-84-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-87-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-86-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-89-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-88-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-90-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-91-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-92-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-93-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-95-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-94-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-96-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-98-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-97-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-100-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/3812-99-0x0000000000A60000-0x0000000000A70000-memory.dmp

    Filesize

    64KB

  • memory/3812-101-0x000000001FB90000-0x000000001FC90000-memory.dmp

    Filesize

    1024KB

  • memory/4240-37-0x00007FF8FE450000-0x00007FF8FEF11000-memory.dmp

    Filesize

    10.8MB

  • memory/4240-30-0x000001F73EF50000-0x000001F73EF72000-memory.dmp

    Filesize

    136KB

  • memory/4240-20-0x00007FF8FE450000-0x00007FF8FEF11000-memory.dmp

    Filesize

    10.8MB

  • memory/4240-19-0x00007FF8FE450000-0x00007FF8FEF11000-memory.dmp

    Filesize

    10.8MB

  • memory/4240-18-0x00007FF8FE453000-0x00007FF8FE455000-memory.dmp

    Filesize

    8KB