Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
06/07/2026, 09:49
General
- Target matcha-installer.exe
- Size 2.6MB
- Sample260706-ltngssds2z
- SHA256 b3ad1389f9962206c973c4acefbb32f3c26cbdb884c6f01445deeeb6f9f9f8e9
Malware Config
Extracted
-
blacknet
-
v3.7.0 Public
-
HacKed
-
http://kalashnikovs-001-site1.jtempurl.com/bk
-
BN[857a86a7ab6cccdcc58aebfdcd8ee5bc]
-
antivm
true
-
elevate_uac
true
-
install_name
WindowsUpdate.exe
-
splitter
|BN|
-
start_name
e162b1333458a713bc6916cc8ac4110c
-
startup
true
-
usb_spread
true
Signatures
- Family: BlackNET
BlackNET is an open source remote access tool written in VB.NET.
- BlackNET payload 1 IoCs
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\matcha-installer.exe"C:\Users\Admin\AppData\Local\Temp\matcha-installer.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_tl3dobob.0f5.ps1
memory/5780-1-0x0000000000E20000-0x00000000010CA000-memory.dmp
memory/5780-0-0x00007FF98F94F000-0x00007FF98F950000-memory.dmp
memory/5780-2-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5780-3-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5780-4-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5780-5-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5780-6-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5780-36-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-17-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-29-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-14-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-15-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-18-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-19-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-20-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-21-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-28-0x00000222333F0000-0x000002223340E000-memory.dmp
memory/5792-16-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-31-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-30-0x0000022233410000-0x00000222334C2000-memory.dmp
memory/5792-32-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-33-0x00000222334D0000-0x00000222334DA000-memory.dmp
memory/5792-34-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-35-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp
memory/5792-12-0x0000022233140000-0x0000022233162000-memory.dmp
memory/5792-38-0x00007FF98F7C0000-0x00007FF990164000-memory.dmp