Analysis
- max time kernel
2s - max time network
7s - platform
windows11-21h2_x64 - resource
win11-20251223-en - resource tags
- submitted
26/12/2025, 02:15
Errors
General
- Target AB589067A6A2C25307F25F2E3CE8CF71.exe
- Size 116KB
- Sample251226-cptctaxpgj
- SHA256 7212509bf08daa26e936de56ddd4d513dc5f18660cd303cf3e05dbb91fdade72
Malware Config
Extracted
-
blacknet
-
v3.7.0 Public
-
Parse2
-
http://carkalashop.ir/aaa
-
BN[e9d7aef9d8686ca0dec66cabc965e365]
-
antivm
false
-
elevate_uac
false
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
true
-
usb_spread
true
Signatures
- BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET payload 2 IoCs
- Blacknet family
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AB589067A6A2C25307F25F2E3CE8CF71.exe"C:\Users\Admin\AppData\Local\Temp\AB589067A6A2C25307F25F2E3CE8CF71.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Microsoft\MyClient\WindowsUpdate.exe"C:\Users\Admin\Microsoft\MyClient\WindowsUpdate.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_jg03gfqy.d5y.ps1
svchosts.exe
WindowsUpdate.exe
memory/1904-0-0x0000000000DE0000-0x0000000000E02000-memory.dmp
memory/1904-1-0x000000001B9A0000-0x000000001B9B0000-memory.dmp
memory/1904-2-0x000000001B9A0000-0x000000001B9B0000-memory.dmp
memory/1904-33-0x000000001B9A0000-0x000000001B9B0000-memory.dmp
memory/4712-21-0x000001AD28F00000-0x000001AD28F0A000-memory.dmp
memory/4712-25-0x000001AD29160000-0x000001AD29168000-memory.dmp
memory/4712-20-0x000001AD28F30000-0x000001AD28FE3000-memory.dmp
memory/4712-12-0x000001AD0FB10000-0x000001AD105D2000-memory.dmp
memory/4712-22-0x000001AD29170000-0x000001AD2918C000-memory.dmp
memory/4712-23-0x000001AD29150000-0x000001AD2915A000-memory.dmp
memory/4712-24-0x000001AD292B0000-0x000001AD292CA000-memory.dmp
memory/4712-19-0x000001AD28F10000-0x000001AD28F2C000-memory.dmp
memory/4712-26-0x000001AD29290000-0x000001AD29296000-memory.dmp
memory/4712-27-0x000001AD292A0000-0x000001AD292AA000-memory.dmp
memory/4712-30-0x000001AD0FB10000-0x000001AD105D2000-memory.dmp
memory/4712-11-0x000001AD0FB10000-0x000001AD105D2000-memory.dmp
memory/4712-4-0x000001AD28C80000-0x000001AD28CA2000-memory.dmp
memory/4712-3-0x000001AD102DA000-0x000001AD102DB000-memory.dmp