Analysis
- max time kernel
120s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
22/10/2024, 10:44
General
- Target 9950eb19c6324cbf66b19995a566096319193e0676516ce0e38ef82552008791N.exe
- Size 80KB
- Sample241022-mtardashjj
- SHA256 9950eb19c6324cbf66b19995a566096319193e0676516ce0e38ef82552008791
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9950eb19c6324cbf66b19995a566096319193e0676516ce0e38ef82552008791N.exe"C:\Users\Admin\AppData\Local\Temp\9950eb19c6324cbf66b19995a566096319193e0676516ce0e38ef82552008791N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_x1tajlxa.fqv.ps1
memory/1740-24-0x00000211FF420000-0x00000211FF430000-memory.dmp
memory/1740-35-0x00000211FF420000-0x00000211FF430000-memory.dmp
memory/1740-25-0x00000211FF380000-0x00000211FF3A2000-memory.dmp
memory/1740-21-0x00007FFADED13000-0x00007FFADED15000-memory.dmp
memory/1740-23-0x00000211FF420000-0x00000211FF430000-memory.dmp
memory/3560-58-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-46-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-8-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-9-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-10-0x000000001F8D0000-0x000000001F932000-memory.dmp
memory/3560-11-0x00007FFAE3395000-0x00007FFAE3396000-memory.dmp
memory/3560-12-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-13-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-14-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-15-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-16-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-61-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-18-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-19-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-20-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-6-0x0000000001240000-0x0000000001248000-memory.dmp
memory/3560-5-0x000000001C5D0000-0x000000001C66C000-memory.dmp
memory/3560-22-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-4-0x000000001C060000-0x000000001C52E000-memory.dmp
memory/3560-3-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-2-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-1-0x000000001BAE0000-0x000000001BB86000-memory.dmp
memory/3560-38-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-39-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-40-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-41-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-42-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-43-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-44-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-45-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-62-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-47-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-48-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-49-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-50-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-51-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-52-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-53-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-55-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-54-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-57-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-56-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-0-0x00007FFAE3395000-0x00007FFAE3396000-memory.dmp
memory/3560-60-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-7-0x000000001C770000-0x000000001C7BC000-memory.dmp
memory/3560-59-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-17-0x00007FFAE30E0000-0x00007FFAE3A81000-memory.dmp
memory/3560-64-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-63-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-66-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-65-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-68-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-67-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-69-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-71-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-70-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-73-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-72-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-74-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-75-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-77-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-76-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-79-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-78-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-81-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-80-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-82-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-83-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-84-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-85-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-87-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-86-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-88-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-90-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-89-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-92-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-91-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-94-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-93-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-95-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-96-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-97-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-98-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-99-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-100-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-101-0x0000000001520000-0x0000000001530000-memory.dmp
memory/3560-102-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-103-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-104-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-105-0x00000000205C0000-0x00000000206C0000-memory.dmp
memory/3560-106-0x0000000001520000-0x0000000001530000-memory.dmp