Analysis
- max time kernel
120s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/10/2024, 07:55
General
- Target d9398c5fdabcb31e4af675563a77dcfff62766a052624853a3823f60e97c5c99N.exe
- Size 80KB
- Sample241021-jse3xsware
- SHA256 d9398c5fdabcb31e4af675563a77dcfff62766a052624853a3823f60e97c5c99
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9398c5fdabcb31e4af675563a77dcfff62766a052624853a3823f60e97c5c99N.exe"C:\Users\Admin\AppData\Local\Temp\d9398c5fdabcb31e4af675563a77dcfff62766a052624853a3823f60e97c5c99N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_y3cbuazm.y5w.ps1
memory/996-15-0x00007FFC5E1C3000-0x00007FFC5E1C5000-memory.dmp
memory/996-34-0x00007FFC5E1C0000-0x00007FFC5EC81000-memory.dmp
memory/996-27-0x00007FFC5E1C0000-0x00007FFC5EC81000-memory.dmp
memory/996-26-0x00007FFC5E1C0000-0x00007FFC5EC81000-memory.dmp
memory/996-21-0x000002686A9E0000-0x000002686AA02000-memory.dmp
memory/4884-57-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-45-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-8-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-9-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-10-0x000000001EF60000-0x000000001EFC2000-memory.dmp
memory/4884-11-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-12-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-13-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-14-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-6-0x00000000008D0000-0x00000000008D8000-memory.dmp
memory/4884-5-0x000000001BC50000-0x000000001BCEC000-memory.dmp
memory/4884-63-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-3-0x000000001B650000-0x000000001BB1E000-memory.dmp
memory/4884-2-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-28-0x00007FFC61FB5000-0x00007FFC61FB6000-memory.dmp
memory/4884-31-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-30-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-29-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-1-0x000000001B0D0000-0x000000001B176000-memory.dmp
memory/4884-35-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-36-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-37-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-38-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-39-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-40-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-41-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-43-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-42-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-44-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-46-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-61-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-48-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-47-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-49-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-50-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-51-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-52-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-53-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-55-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-54-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-56-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-58-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-0-0x00007FFC61FB5000-0x00007FFC61FB6000-memory.dmp
memory/4884-60-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-7-0x000000001BDB0000-0x000000001BDFC000-memory.dmp
memory/4884-59-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-4-0x00007FFC61D00000-0x00007FFC626A1000-memory.dmp
memory/4884-62-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-64-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-66-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-65-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-67-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-69-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-68-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-70-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-71-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-72-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-74-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-73-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-76-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-75-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-77-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-78-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-80-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-79-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-82-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-81-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-83-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-84-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-85-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-87-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-86-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-88-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-89-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-90-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-92-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-91-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-94-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-93-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-96-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-95-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-97-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-98-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-99-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-100-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-101-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-102-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-103-0x0000000000B20000-0x0000000000B30000-memory.dmp
memory/4884-105-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-104-0x000000001FAB0000-0x000000001FBB0000-memory.dmp
memory/4884-106-0x0000000000B20000-0x0000000000B30000-memory.dmp