dawn[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dawn.exe
Size 3.3MB
Sample260708-mzzyfsev4x
SHA256 db0b26b347783e46f934c7d408e000556d480b79181fb4963fa762c389f87278
MD5 d53a55bae8cbe83d098cbaec84148842
SHA1 6dec8c9d1207327c9bd44349caa1f8204213d09c
SHA512 d7b6b35310ce07e8fcff49101b59cf2f2938498104684cb0efeb9821cc5ec320f2f5edd94d5dd23d164daa59d3ecb1cf7a39b7b590ac611c0cddf61383684d4c
SSDEEP 98304:9vIkamauIdsyxrKhCPjrHcYNptUo5OUMja:9fanf9+sjr8mptU6OU6a
TLSH
T137F51221244D911BD29E1E32B342FBA609532FD554CD2432F69B3E6FF936B72E809583
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NScurl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

dawn.exe

.exe 3.3MB
$PLUGINSDIR/NScurl.dll

.dll 7.6MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsExec.dll

.dll 7KB

dawn.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 db0b26b347783e46f934c7d408e000556d480b79181fb4963fa762c389f87278
MD5 d53a55bae8cbe83d098cbaec84148842
SHA1 6dec8c9d1207327c9bd44349caa1f8204213d09c
SHA512 d7b6b35310ce07e8fcff49101b59cf2f2938498104684cb0efeb9821cc5ec320f2f5edd94d5dd23d164daa59d3ecb1cf7a39b7b590ac611c0cddf61383684d4c
SSDEEP 98304:9vIkamauIdsyxrKhCPjrHcYNptUo5OUMja:9fanf9+sjr8mptU6OU6a
TLSH
T137F51221244D911BD29E1E32B342FBA609532FD554CD2432F69B3E6FF936B72E809583
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

00:91:58:7b:d9:a2:86:75:28:77:57:23:6f:a5:02:64:14:72:7a:51:e3:c4:82:b6:b3:a4:f2:dc:db:3c:4d:66

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=InPvP Inc,O=InPvP Inc,L=Dover,ST=Delaware,C=US

Chains

Jun 24, 2026

CN=InPvP Inc,O=InPvP Inc,L=Dover,ST=Delaware,C=US

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=InPvP Inc,O=InPvP Inc,L=Dover,ST=Delaware,C=US

Serial Number

33:00:02:62:2f:31:6f:8c:fb:78:eb:a5:8d:00:00:00:02:62:2f

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 22, 2026 - Jun 25, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NScurl.dll

IMPHASH 9d985158a544ee0236883964a6db59d3
SHA256 efe7d99833a05f3d25cb7b151f156de3b1ee347306d2bc23a920828d3831b06b
MD5 923540c263c7e649801d996a5abe6151
SHA1 622133ff6d471a1f1b34ee6c06320e744403f4ce
SHA512 5ff4c3b28a15fd22f3294a397f638031e0a53efcf96fa7cb46e2397a193e5beab33dfcd627a5dfadfb136903afeb0b40328e41bea07551edaa9e5af2e855f986
SSDEEP 196608:U1eO+SNs5e4BWrZay5LDTs4bY6Bj5vuMYAKzOZE/XZfZZ21jPB4:WQcFuMU7Sq
TLSH
T1D6864A94FFCB44F1E90788B088E7B37F8B34A7158025D6AAEE5C1E56F933701161A35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5668784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext DeregisterEventSource RegisterEventSourceW ReportEventW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenSystemStoreW

kernel32

CloseHandle CompareFileTime CompareStringA CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateSemaphoreA CreateThread DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileA FindFirstFileW FindNextFileW FindResourceExW FormatMessageA FormatMessageW FreeLibrary GetACP GetCPInfo GetConsoleMode GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileSize GetFileType GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTickCount GetVersion GetVersionExW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LockResource MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleA ReadConsoleW ReadFile ReleaseSemaphore ResetEvent SetConsoleMode SetEvent SetFilePointer SetLastError SizeofResource Sleep SleepEx SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiA lstrcmpiW lstrcpyW lstrcpynA lstrcpynW lstrlenA lstrlenW

msvcrt

__lc_codepage __p__iob __p___mb_cur_max _amsg_exit _assert _beginthreadex _close _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fstati64 _fullpath _get_osfhandle _initterm _lock _lseek _read _setmode _snprintf _snwprintf _stat _strdup _strdup _unlink _unlock _vsnprintf _vsnwprintf _wfopen _wfreopen _wfsopen _write _wsopen _wstati64 _wtoi64 abort atoi bsearch calloc fclose feof ferror fflush fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos ftell fwrite getc getenv gmtime isdigit islower isspace isupper isxdigit localeconv malloc memchr memcmp memcpy memmove memset qsort raise realloc setvbuf signal sprintf strcat strchr strcmp strcpy strcspn strerror strftime strlen strncmp strncpy strpbrk time strrchr strspn strstr strtol strtoul tolower ungetc vfprintf wcscat wcscpy wcslen wcsncmp wcsstr wcstombs wprintf

user32

CallWindowProcW CopyRect CreateDialogParamW CreateWindowExW DestroyIcon DestroyWindow DispatchMessageW EnableMenuItem EnableWindow FindWindowExW GetDesktopWindow GetDlgItem GetProcessWindowStation GetPropW GetSystemMenu GetSystemMetrics GetUserObjectInformationW GetWindow GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDialogMessageW IsWindow IsWindowEnabled IsWindowVisible LoadImageW MessageBoxW MsgWaitForMultipleObjects OffsetRect PeekMessageW RemovePropW ScreenToClient SendDlgItemMessageW SendMessageW SetForegroundWindow SetPropW SetRectEmpty SetWindowLongW SetWindowPos SetWindowTextW TranslateMessage wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSASocketA WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect gethostbyaddr gethostbyname getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

5.4MB

Virtual Size

5.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

710KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dawn.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NScurl.dll

advapi32

crypt32

kernel32

msvcrt

user32

version

ws2_32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic