Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
19/10/2024, 10:19
General
- Target 2eff673215f0e9e06360cba2f69fd769f516c55c0bb3ceeec939e48b7432a40bN.exe
- Size 80KB
- Sample241019-mcvp8a1cqd
- SHA256 2eff673215f0e9e06360cba2f69fd769f516c55c0bb3ceeec939e48b7432a40b
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2eff673215f0e9e06360cba2f69fd769f516c55c0bb3ceeec939e48b7432a40bN.exe"C:\Users\Admin\AppData\Local\Temp\2eff673215f0e9e06360cba2f69fd769f516c55c0bb3ceeec939e48b7432a40bN.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5aasdoyz.jnk.ps1
memory/1048-31-0x00007FFB26820000-0x00007FFB272E1000-memory.dmp
memory/1048-16-0x00007FFB26823000-0x00007FFB26825000-memory.dmp
memory/1048-22-0x000001F341090000-0x000001F3410B2000-memory.dmp
memory/1048-27-0x00007FFB26820000-0x00007FFB272E1000-memory.dmp
memory/1048-29-0x00007FFB26820000-0x00007FFB272E1000-memory.dmp
memory/1048-37-0x00007FFB26820000-0x00007FFB272E1000-memory.dmp
memory/1968-58-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-70-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-4-0x000000001C600000-0x000000001C69C000-memory.dmp
memory/1968-5-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-6-0x0000000001490000-0x0000000001498000-memory.dmp
memory/1968-7-0x000000001C760000-0x000000001C7AC000-memory.dmp
memory/1968-8-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-9-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-10-0x000000001F950000-0x000000001F9B2000-memory.dmp
memory/1968-11-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-12-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-13-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-14-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-15-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-28-0x00007FFB2A235000-0x00007FFB2A236000-memory.dmp
memory/1968-30-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-2-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-32-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-34-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-33-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-1-0x000000001BA60000-0x000000001BB06000-memory.dmp
memory/1968-38-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-39-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-40-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-41-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-42-0x00007FFB29F80000-0x00007FFB2A921000-memory.dmp
memory/1968-61-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-44-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-45-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-46-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-47-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-48-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-49-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-50-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-51-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-52-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-53-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-54-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-55-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-56-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-57-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-0-0x00007FFB2A235000-0x00007FFB2A236000-memory.dmp
memory/1968-59-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-60-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-43-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-3-0x000000001BFE0000-0x000000001C4AE000-memory.dmp
memory/1968-67-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-64-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-66-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-65-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-63-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-68-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-69-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-71-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-62-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-72-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-73-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-75-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-74-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-76-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-78-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-77-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-79-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-80-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-82-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-81-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-83-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-85-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-84-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-86-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-87-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-88-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-89-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-90-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-92-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-91-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-93-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-95-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-94-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-96-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-97-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-98-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-99-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-101-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-100-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-102-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-103-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-104-0x00000000014D0000-0x00000000014E0000-memory.dmp
memory/1968-105-0x0000000020740000-0x0000000020840000-memory.dmp
memory/1968-106-0x00000000014D0000-0x00000000014E0000-memory.dmp