Analysis
- max time kernel
118s - max time network
112s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/10/2024, 01:54
General
- Target 1cefdb482ee4d0b22a8987f9faeeaef40052ac48c6bfa3809b44b592616eaed4N.exe
- Size 80KB
- Sample241020-cbzyfasbne
- SHA256 1cefdb482ee4d0b22a8987f9faeeaef40052ac48c6bfa3809b44b592616eaed4
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cefdb482ee4d0b22a8987f9faeeaef40052ac48c6bfa3809b44b592616eaed4N.exe"C:\Users\Admin\AppData\Local\Temp\1cefdb482ee4d0b22a8987f9faeeaef40052ac48c6bfa3809b44b592616eaed4N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_t4z12lef.dg3.ps1
memory/3008-39-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-17-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-3-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-4-0x000000001BEF0000-0x000000001C3BE000-memory.dmp
memory/3008-5-0x000000001C510000-0x000000001C5AC000-memory.dmp
memory/3008-6-0x000000001B9F0000-0x000000001B9F8000-memory.dmp
memory/3008-7-0x000000001C670000-0x000000001C6BC000-memory.dmp
memory/3008-8-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-9-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-10-0x000000001D0F0000-0x000000001D152000-memory.dmp
memory/3008-12-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-11-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-13-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-14-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-15-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-16-0x00007FFF3DFB5000-0x00007FFF3DFB6000-memory.dmp
memory/3008-49-0x00000000204C0000-0x00000000205C0000-memory.dmp
memory/3008-48-0x0000000001360000-0x0000000001370000-memory.dmp
memory/3008-2-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-1-0x000000001B930000-0x000000001B9D6000-memory.dmp
memory/3008-47-0x00000000204C0000-0x00000000205C0000-memory.dmp
memory/3008-46-0x00000000204C0000-0x00000000205C0000-memory.dmp
memory/3008-45-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-30-0x00000000204C0000-0x00000000205C0000-memory.dmp
memory/3008-35-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-36-0x00000000204C0000-0x00000000205C0000-memory.dmp
memory/3008-37-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-38-0x0000000001360000-0x0000000001370000-memory.dmp
memory/3008-40-0x00000000204C0000-0x00000000205C0000-memory.dmp
memory/3008-0-0x00007FFF3DFB5000-0x00007FFF3DFB6000-memory.dmp
memory/3008-41-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-42-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-43-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/3008-44-0x00007FFF3DD00000-0x00007FFF3E6A1000-memory.dmp
memory/4092-29-0x00007FFF3A740000-0x00007FFF3B201000-memory.dmp
memory/4092-31-0x0000029733AB0000-0x0000029733AD2000-memory.dmp
memory/4092-34-0x00007FFF3A740000-0x00007FFF3B201000-memory.dmp
memory/4092-18-0x00007FFF3A743000-0x00007FFF3A745000-memory.dmp
memory/4092-28-0x00007FFF3A740000-0x00007FFF3B201000-memory.dmp