Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    12-01-2022 17:52

General

  • Target

    bb0a3c784e55bd25f845644b69c57e3e470af51983617fdfe7ba5d253019ed24.bin.dll

  • Size

    366KB

  • MD5

    e69294040dab044805c9d7c47fef4844

  • SHA1

    f3a2731e174a68d13b4ae15fab2d7b2788517039

  • SHA256

    bb0a3c784e55bd25f845644b69c57e3e470af51983617fdfe7ba5d253019ed24

  • SHA512

    c1a7bc64f9edf804ef7707dd717e7f8d293a607a96b9339e4acf2fdee1b70c643c1987016882620654c709795775042db9461da11cd4b1a016ea98fcd8e20a8c

Malware Config

Signatures

  • GoldDragon

    GoldDragon is a second-stage backdoor attributed to Kimsuky.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates processes with tasklist 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Gathers system information 1 TTPs 1 IoCs

    Runs systeminfo.exe.

  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0a3c784e55bd25f845644b69c57e3e470af51983617fdfe7ba5d253019ed24.bin.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb0a3c784e55bd25f845644b69c57e3e470af51983617fdfe7ba5d253019ed24.bin.dll,#1
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1536
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c taskkill /f /im daumcleaner.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:880
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im daumcleaner.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:664
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c ipconfig/all >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat" & arp -a >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1780
        • C:\Windows\SysWOW64\ipconfig.exe
          ipconfig /all
          4⤵
          • Gathers network information
          PID:1772
        • C:\Windows\SysWOW64\ARP.EXE
          arp -a
          4⤵
            PID:972
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c systeminfo >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1928
          • C:\Windows\SysWOW64\systeminfo.exe
            systeminfo
            4⤵
            • Gathers system information
            PID:1752
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c tasklist >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1084
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            4⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1712
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          3⤵
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of WriteProcessMemory
          PID:1992
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c netstat -a >> "C:\Users\Admin\AppData\Roaming\wininit.db"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\SysWOW64\NETSTAT.EXE
              netstat -a
              5⤵
              • Gathers network information
              • Suspicious use of AdjustPrivilegeToken
              PID:1636

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1536-55-0x0000000075D51000-0x0000000075D53000-memory.dmp

      Filesize

      8KB

    • memory/1992-69-0x0000000000180000-0x00000000001DA000-memory.dmp

      Filesize

      360KB

    • memory/1992-72-0x0000000000180000-0x00000000001DA000-memory.dmp

      Filesize

      360KB

    • memory/1992-68-0x0000000000180000-0x00000000001DA000-memory.dmp

      Filesize

      360KB