General
- Target dawn-client-setup-win-1.0.16.exe
- Size 77.2MB
- Sample260620-ynyrssas8y
- SHA256 a643f52a758785eed0c4ea16b7833ee57a08c29553a277ef6da26da191bd6bba
Malware Config
Targets
-
- Target dawn-client-setup-win-1.0.16.exe
- Size 77.2MB
- SHA256 a643f52a758785eed0c4ea16b7833ee57a08c29553a277ef6da26da191bd6bba
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target Dawn Client.exe
- Size 117.9MB
- SHA256 3cb133813916e6d00d51eb62d709cc9de4d1e5a2cc064781d8dd44d5c1a30c88
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target LICENSES.chromium.html
- Size 4.4MB
- SHA256 7c40e8639f24a7f2a509cb4782f79848c9af1dc985f17a09a6d2b8de3518271d
Score4/10 -
- Target d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 6120f574e90b83a96702cfc93e8316fad4ea22669cca19e2e49b0db8b5f7e4b1
Score1/10 -
- Target libEGL.dll
- Size 428KB
- SHA256 2907d96beb8ba1f7c705b654fec66cfacfe7cf3912d043aad5a8ffac91e45456
Score1/10 -
- Target libGLESv2.dll
- Size 9.2MB
- SHA256 bff3726dace1f22da9e1333384b08c968d9c139f93f3c8ff221067017bd6fb92
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/ffmpeg-static/ffmpeg.exe
- Size 77.4MB
- SHA256 e9fd5e711debab9d680955fc1e38a2c1160fd280b144476cc3f62bc43ef49db1
Score1/10 -
- Target resources/app.asar.unpacked/node_modules/ffmpeg-static/index.js
- Size 1KB
- SHA256 ca4ca945d60557d20f99c11fdcd338f85a55ff38b19868b1e8755b7a5c350a9d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/ffmpeg-static/install.js
- Size 6KB
- SHA256 9801ce3aa35e45f72f7d13339ff04c916011b529040d1a1301c74102ed335fb9
Score3/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target swiftshader/libEGL.dll
- Size 454KB
- SHA256 2d60a59c38d5d57865c6201eb22f7d692c283f61e2ec92a275637d77861f2057
Score1/10 -
- Target swiftshader/libGLESv2.dll
- Size 3.0MB
- SHA256 18d5d0b6670ef41c94ea2924edbfa89c8ac5d069d4209128f3e2311704f16268
Score1/10
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2