golddragon | c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe
Size

100KB
MD5

c605b7c3e4c339642db6a33c5780b49b
SHA1

c2f01355880cd9dfeef75cff189f4a8af421e0d3
SHA256

c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82
SHA512

02ad68001d5e7754469584dd833ec902f56fd68222937819a5174450d18dc037cbcfdd8df770365d452519ef4c9081ecfd19e38f08fda2f78c441a1062a9cb26

Score

10^/10

golddragon backdoor

Malware Config

Signatures

GoldDragon
GoldDragon is a second-stage backdoor attributed to Kimsuky.
backdoor golddragon

Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery

T1057

pid	Process
1040	tasklist.exe
1900	tasklist.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
580	systeminfo.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe
Token: SeDebugPrivilege	1040	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 584	1220	c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe	27
PID 1220 wrote to memory of 584	1220	c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe	27
PID 1220 wrote to memory of 584	1220	c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe	27
PID 1220 wrote to memory of 584	1220	c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe	27
PID 584 wrote to memory of 580	584	cmd.exe	29
PID 584 wrote to memory of 580	584	cmd.exe	29
PID 584 wrote to memory of 580	584	cmd.exe	29
PID 584 wrote to memory of 580	584	cmd.exe	29
PID 584 wrote to memory of 1040	584	cmd.exe	32
PID 584 wrote to memory of 1040	584	cmd.exe	32
PID 584 wrote to memory of 1040	584	cmd.exe	32
PID 584 wrote to memory of 1040	584	cmd.exe	32
PID 584 wrote to memory of 1900	584	cmd.exe	33
PID 584 wrote to memory of 1900	584	cmd.exe	33
PID 584 wrote to memory of 1900	584	cmd.exe	33
PID 584 wrote to memory of 1900	584	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe
"C:\Users\Admin\AppData\Local\Temp\c54837d0b856205bd4ae01887aae9178f55f16e0e1a1e1ff59bd18dbc8a3dd82.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:580
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /M
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-54-0x0000000076C61000-0x0000000076C63000-memory.dmp

Filesize
8KB

Download