Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
19/10/2024, 03:02
General
- Target 2ecc4e20ccad2d19bfdc9168275a60ee2d4ab40d4a16cf8c12a414b5ea2d185bN.exe
- Size 80KB
- Sample241019-djm5aatbpc
- SHA256 2ecc4e20ccad2d19bfdc9168275a60ee2d4ab40d4a16cf8c12a414b5ea2d185b
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ecc4e20ccad2d19bfdc9168275a60ee2d4ab40d4a16cf8c12a414b5ea2d185bN.exe"C:\Users\Admin\AppData\Local\Temp\2ecc4e20ccad2d19bfdc9168275a60ee2d4ab40d4a16cf8c12a414b5ea2d185bN.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_o4f4ahe2.jgy.ps1
memory/540-83-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-60-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-3-0x000000001B5E0000-0x000000001BAAE000-memory.dmp
memory/540-4-0x000000001BB80000-0x000000001BC1C000-memory.dmp
memory/540-5-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-6-0x0000000000B20000-0x0000000000B28000-memory.dmp
memory/540-7-0x000000001BCE0000-0x000000001BD2C000-memory.dmp
memory/540-8-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-58-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-10-0x000000001EE90000-0x000000001EEF2000-memory.dmp
memory/540-11-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-12-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-13-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-14-0x00007FF97C855000-0x00007FF97C856000-memory.dmp
memory/540-16-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-15-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-106-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-17-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-105-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-1-0x000000001AFF0000-0x000000001B096000-memory.dmp
memory/540-104-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-30-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-103-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-101-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-35-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-36-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-37-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-38-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-39-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-40-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-41-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-42-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-57-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-44-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-45-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-46-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-47-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-49-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-48-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-50-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-51-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-52-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-53-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-54-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-55-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-56-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-43-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-2-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-9-0x00007FF97C5A0000-0x00007FF97CF41000-memory.dmp
memory/540-59-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-62-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-61-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-63-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-64-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-65-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-66-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-67-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-68-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-69-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-71-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-70-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-72-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-73-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-74-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-76-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-75-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-77-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-78-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-79-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-80-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-81-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-0-0x00007FF97C855000-0x00007FF97C856000-memory.dmp
memory/540-82-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-85-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-84-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-86-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-87-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-88-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-89-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-90-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-91-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-92-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-93-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-94-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-95-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-96-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-97-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/540-98-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-100-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-99-0x0000000000650000-0x0000000000660000-memory.dmp
memory/540-102-0x000000001FA80000-0x000000001FB80000-memory.dmp
memory/2072-34-0x00007FF9787C0000-0x00007FF979281000-memory.dmp
memory/2072-29-0x00007FF9787C0000-0x00007FF979281000-memory.dmp
memory/2072-31-0x0000022A37AF0000-0x0000022A37B00000-memory.dmp
memory/2072-28-0x0000022A37A40000-0x0000022A37A62000-memory.dmp
memory/2072-18-0x00007FF9787C3000-0x00007FF9787C5000-memory.dmp