Analysis
- max time kernel
120s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
28/10/2024, 09:40
General
- Target 4b7b91cc84638792897cce3b22e7eca993493a06a0b1c510b748c361a5371cb0N.exe
- Size 80KB
- Sample241028-lnfvrswbqf
- SHA256 4b7b91cc84638792897cce3b22e7eca993493a06a0b1c510b748c361a5371cb0
Malware Config
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- Blacknet family
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b7b91cc84638792897cce3b22e7eca993493a06a0b1c510b748c361a5371cb0N.exe"C:\Users\Admin\AppData\Local\Temp\4b7b91cc84638792897cce3b22e7eca993493a06a0b1c510b748c361a5371cb0N.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_z0ronkxv.t2x.ps1
memory/2088-33-0x00007FFCB96A0000-0x00007FFCBA161000-memory.dmp
memory/2088-22-0x00007FFCB96A3000-0x00007FFCB96A5000-memory.dmp
memory/2088-27-0x000001E07B140000-0x000001E07B162000-memory.dmp
memory/2088-28-0x00007FFCB96A0000-0x00007FFCBA161000-memory.dmp
memory/2088-29-0x00007FFCB96A0000-0x00007FFCBA161000-memory.dmp
memory/2596-58-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-46-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-4-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-3-0x000000001BE80000-0x000000001C34E000-memory.dmp
memory/2596-5-0x000000001C3F0000-0x000000001C48C000-memory.dmp
memory/2596-6-0x0000000001160000-0x0000000001168000-memory.dmp
memory/2596-7-0x000000001C580000-0x000000001C5CC000-memory.dmp
memory/2596-8-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-9-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-10-0x000000001D700000-0x000000001D762000-memory.dmp
memory/2596-11-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-63-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-13-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-14-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-15-0x00007FFCBD925000-0x00007FFCBD926000-memory.dmp
memory/2596-16-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-30-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-1-0x000000001B870000-0x000000001B916000-memory.dmp
memory/2596-34-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-36-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-35-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-37-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-39-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-38-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-40-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-41-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-42-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-43-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-44-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-45-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-61-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-47-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-48-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-49-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-50-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-51-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-52-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-53-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-54-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-55-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-56-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-57-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-0-0x00007FFCBD925000-0x00007FFCBD926000-memory.dmp
memory/2596-59-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-2-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-60-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-12-0x00007FFCBD670000-0x00007FFCBE011000-memory.dmp
memory/2596-62-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-65-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-64-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-66-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-67-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-68-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-69-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-71-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-70-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-72-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-73-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-75-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-74-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-76-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-77-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-79-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-78-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-80-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-81-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-82-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-83-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-84-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-85-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-86-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-87-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-88-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-89-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-90-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-91-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-93-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-92-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-94-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-95-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-96-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-97-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-98-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-99-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-100-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-101-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-102-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-103-0x0000000020280000-0x0000000020380000-memory.dmp
memory/2596-104-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-105-0x00000000011D0000-0x00000000011E0000-memory.dmp
memory/2596-106-0x0000000020280000-0x0000000020380000-memory.dmp