Analysis
- max time kernel
150s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
20/10/2024, 14:11
General
- Target 77aedb0102f6a55e5ffca05bec4101b76a472ccc615b47023ba563d385baa8c7.exe
- Size 80KB
- Sample241020-rhlfyssclh
- SHA256 77aedb0102f6a55e5ffca05bec4101b76a472ccc615b47023ba563d385baa8c7
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET payload 1 IoCs
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\77aedb0102f6a55e5ffca05bec4101b76a472ccc615b47023ba563d385baa8c7.exe"C:\Users\Admin\AppData\Local\Temp\77aedb0102f6a55e5ffca05bec4101b76a472ccc615b47023ba563d385baa8c7.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft\MyClient\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
WindowsUpdate.exe
__PSScriptPolicyTest_wkrj4z1c.zk3.ps1
memory/948-73-0x0000000000AD0000-0x0000000000AE0000-memory.dmp
memory/948-54-0x0000000000AD0000-0x0000000000AE0000-memory.dmp
memory/3612-10-0x000000001DBE0000-0x000000001DC42000-memory.dmp
memory/3612-6-0x00000000014F0000-0x00000000014F8000-memory.dmp
memory/3612-8-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-9-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-0-0x00007FF8413B5000-0x00007FF8413B6000-memory.dmp
memory/3612-11-0x00007FF8413B5000-0x00007FF8413B6000-memory.dmp
memory/3612-12-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-13-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-16-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-18-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-17-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-19-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-22-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-23-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-24-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-25-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-1-0x000000001BD90000-0x000000001BE36000-memory.dmp
memory/3612-7-0x000000001CA20000-0x000000001CA6C000-memory.dmp
memory/3612-3-0x000000001C380000-0x000000001C84E000-memory.dmp
memory/3612-2-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-56-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-40-0x0000000020B50000-0x0000000020C50000-memory.dmp
memory/3612-39-0x0000000020B50000-0x0000000020C50000-memory.dmp
memory/3612-41-0x0000000020B50000-0x0000000020C50000-memory.dmp
memory/3612-5-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-52-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/3612-4-0x000000001C8F0000-0x000000001C98C000-memory.dmp
memory/3612-53-0x00007FF841100000-0x00007FF841AA1000-memory.dmp
memory/4016-38-0x00007FF83C6B0000-0x00007FF83D171000-memory.dmp
memory/4016-59-0x00007FF83C6B0000-0x00007FF83D171000-memory.dmp
memory/4016-37-0x00007FF83C6B0000-0x00007FF83D171000-memory.dmp
memory/4016-28-0x000001B947A00000-0x000001B947A22000-memory.dmp
memory/4016-26-0x00007FF83C6B3000-0x00007FF83C6B5000-memory.dmp
memory/4060-72-0x000002881DD70000-0x000002881DEDA000-memory.dmp