Analysis
- max time kernel
120s - max time network
105s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/10/2024, 11:40
General
- Target 89a74de810253d0eff8c56d355c7f957fffd9348d202f6c52f0e6f902c434c60N.exe
- Size 80KB
- Sample241021-ntabaathqm
- SHA256 89a74de810253d0eff8c56d355c7f957fffd9348d202f6c52f0e6f902c434c60
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\89a74de810253d0eff8c56d355c7f957fffd9348d202f6c52f0e6f902c434c60N.exe"C:\Users\Admin\AppData\Local\Temp\89a74de810253d0eff8c56d355c7f957fffd9348d202f6c52f0e6f902c434c60N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ijxpva1y.hwv.ps1
memory/1168-59-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-83-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-2-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-3-0x000000001BDA0000-0x000000001C26E000-memory.dmp
memory/1168-4-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-5-0x000000001C310000-0x000000001C3AC000-memory.dmp
memory/1168-6-0x0000000000F70000-0x0000000000F78000-memory.dmp
memory/1168-7-0x000000001C490000-0x000000001C4DC000-memory.dmp
memory/1168-60-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-9-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-10-0x000000001F2B0000-0x000000001F312000-memory.dmp
memory/1168-12-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-11-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-13-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-14-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-15-0x00007FFDC0E85000-0x00007FFDC0E86000-memory.dmp
memory/1168-16-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-30-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-32-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-31-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-37-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-105-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-106-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-104-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-102-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-36-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-39-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-38-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-40-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-42-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-41-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-43-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-58-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-45-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-47-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-46-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-48-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-50-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-49-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-51-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-53-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-52-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-54-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-55-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-56-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-57-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-44-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-61-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-8-0x00007FFDC0BD0000-0x00007FFDC1571000-memory.dmp
memory/1168-0-0x00007FFDC0E85000-0x00007FFDC0E86000-memory.dmp
memory/1168-62-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-63-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-64-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-65-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-67-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-66-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-68-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-69-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-70-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-71-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-73-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-72-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-74-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-75-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-76-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-77-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-79-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-78-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-81-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-80-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-1-0x000000001B820000-0x000000001B8C6000-memory.dmp
memory/1168-82-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-84-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-85-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-87-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-86-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-89-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-88-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-90-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-91-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-92-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-94-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-93-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-95-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-96-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-97-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-99-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-98-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/1168-100-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-101-0x0000000020390000-0x0000000020490000-memory.dmp
memory/1168-103-0x0000000000F60000-0x0000000000F70000-memory.dmp
memory/4928-28-0x00000182E7880000-0x00000182E78A2000-memory.dmp
memory/4928-29-0x00007FFDBD100000-0x00007FFDBDBC1000-memory.dmp
memory/4928-27-0x00007FFDBD100000-0x00007FFDBDBC1000-memory.dmp
memory/4928-17-0x00007FFDBD103000-0x00007FFDBD105000-memory.dmp
memory/4928-35-0x00007FFDBD100000-0x00007FFDBDBC1000-memory.dmp