Overview

overview

10

Static

static

ebook.exe.org.exe

windows7_x64

10

ebook.exe.org.exe

windows10_x64

8

Analysis

  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    09/11/2021, 10:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ebook.exe.org.exe

  • Size

    28.2MB

  • MD5

    07f79b595254bd60ccec7561e858de35

  • SHA1

    6199b33c52351cdc5d6cd1b61bb9f3602c9eb799

  • SHA256

    dbd9cfa3d9b4e482ee79e7726e95168a5e27bb0482a0e4744a1e1c56d75f1c32

  • SHA512

    6ca0a66adebe69b10e2c79f75441f264e8481d481731ba3bde0ee522f64761558fc74739a1a43b411708d0c6169a92167febd490a0cd96693236de29fc37362b

Score
10/10
golddragonbackdoordiscovery

Malware Config

Signatures

  • GoldDragon

    GoldDragon is a second-stage backdoor attributed to Kimsuky.

    backdoorgolddragon
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ebook.exe.org.exe
    "C:\Users\Admin\AppData\Local\Temp\ebook.exe.org.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\is-FT0QC.tmp\ebook.exe.org.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-FT0QC.tmp\ebook.exe.org.tmp" /SL5="$400EA,28982256,486912,C:\Users\Admin\AppData\Local\Temp\ebook.exe.org.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1416
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://icecreamapps.com/Ebook-Reader/thankyou.html?v=5.21
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:964 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1868
      • C:\Program Files (x86)\Icecream Ebook Reader\ebookreader.exe
        "C:\Program Files (x86)\Icecream Ebook Reader\ebookreader.exe" -inst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1424
        • C:\Program Files\Internet Explorer\iexplore.exe
          "C:\Program Files\Internet Explorer\iexplore.exe" http://icecreamapps.com/Download-Ebook-Reader/
          4⤵
          • Modifies Internet Explorer Phishing Filter
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1488
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of SetWindowsHookEx
            PID:796
          • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PBXRT4TL\ebook_reader_setup.exe
            "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PBXRT4TL\ebook_reader_setup.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1008
            • C:\Users\Admin\AppData\Local\Temp\is-O3LR2.tmp\ebook_reader_setup.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-O3LR2.tmp\ebook_reader_setup.tmp" /SL5="$30172,28964596,486912,C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PBXRT4TL\ebook_reader_setup.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:1012
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" https://icecreamapps.com/Ebook-Reader/thankyou.html?v=5.30
                7⤵
                  PID:1700
                • C:\Program Files (x86)\Icecream Ebook Reader\ebookreader.exe
                  "C:\Program Files (x86)\Icecream Ebook Reader\ebookreader.exe" -inst
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: AddClipboardFormatListener
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of SetWindowsHookEx
                  PID:480

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/480-149-0x0000000000720000-0x000000000083D000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/964-69-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1008-143-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

      Download

    • memory/1012-145-0x0000000074591000-0x0000000074593000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1012-144-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1416-64-0x0000000074341000-0x0000000074343000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1416-63-0x0000000000240000-0x0000000000241000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1420-62-0x0000000000400000-0x0000000000481000-memory.dmp

      Filesize

      516KB

      Download

    • memory/1420-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmp

      Filesize

      8KB

      Download

    • memory/1424-83-0x0000000000580000-0x000000000069D000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/1488-136-0x0000000002F50000-0x0000000002F51000-memory.dmp

      Filesize

      4KB

      Download