General
- Target SaMarinDaUI.exe
- Size 22KB
- Sample260913-w74q2ssamf
- SHA256 d197c7226be8a9d9636be27bcf2aa384f3bb7ca08504348624d7188a17fa0d9f
Score
10/10
Malware Config
Targets
-
- Target SaMarinDaUI.exe
- Size 22KB
- SHA256 d197c7226be8a9d9636be27bcf2aa384f3bb7ca08504348624d7188a17fa0d9f
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify Tools
1