Static task
static1
Behavioral task
behavioral1
Sample
323d0cf9ac1c750761f66482154dbd3144dae7336c955a4576cb4cce6438a6ba.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
323d0cf9ac1c750761f66482154dbd3144dae7336c955a4576cb4cce6438a6ba.exe
Resource
win10v2004-en-20220113
General
-
Target
323d0cf9ac1c750761f66482154dbd3144dae7336c955a4576cb4cce6438a6ba
-
Size
1.1MB
-
MD5
eec690302795ed155f0b1ccc5b3bb9a9
-
SHA1
856956c954442ff1a1b91afcc01a3b5bcb82900c
-
SHA256
323d0cf9ac1c750761f66482154dbd3144dae7336c955a4576cb4cce6438a6ba
-
SHA512
7b95a8b3d9690e202d6d1c16b878c97921e6e386f6b509f1a5c24923722cf926d54f12b6792d5d901d0a39fcc38e630ffc356d3513a92db62077046fedccc152
-
SSDEEP
24576:HI4hmi5NopRUm3CHGbgn1Eamt3fUSakyl0TD2w998mg2s:H2i5NC3Cmbg1ET3Rakyl0vB8mg2s
Malware Config
Signatures
-
GoldenSpy Payload 1 IoCs
Processes:
resource yara_rule sample goldenspy_svm_payload -
Goldenspy family
Files
-
323d0cf9ac1c750761f66482154dbd3144dae7336c955a4576cb4cce6438a6ba.exe windows x86
be4aab2fb5cd36db72cfa50b61115daf
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LocalFree
GetVersionExA
GetTickCount
CreateMutexA
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
ReadFile
IsDBCSLeadByteEx
WriteFile
SetFilePointer
CreateFileW
MultiByteToWideChar
GetFileSize
WideCharToMultiByte
GetCurrentDirectoryA
SetCurrentDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleA
SystemTimeToFileTime
CreateDirectoryA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SetLastError
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
HeapAlloc
CloseHandle
Process32Next
Sleep
CreateToolhelp32Snapshot
OpenProcess
TerminateProcess
OutputDebugStringA
GetCurrentProcess
HeapFree
Process32First
DeleteFileA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
FileTimeToSystemTime
SetFileAttributesA
LoadResource
LockResource
FreeResource
FindResourceA
SizeofResource
GetLocalTime
DeleteCriticalSection
DecodePointer
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExA
HeapReAlloc
FlushFileBuffers
GetTimeZoneInformation
DeleteFileW
GetFileAttributesExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
WinExec
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
CopyFileA
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetFileType
GetACP
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleHandleExW
ExitProcess
QueryPerformanceFrequency
LoadLibraryExW
RtlUnwind
OutputDebugStringW
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
user32
GetSystemMetrics
GetDesktopWindow
advapi32
ChangeServiceConfig2A
RegEnumKeyExA
RegCreateKeyA
DeregisterEventSource
CreateServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
DeleteService
ControlService
StartServiceA
ReportEventA
RegisterEventSourceA
CloseServiceHandle
OpenSCManagerA
OpenServiceA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegDeleteValueA
ole32
CLSIDFromProgID
CoCreateGuid
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
GetErrorInfo
SysAllocString
VariantClear
shlwapi
PathIsDirectoryA
wininet
InternetConnectA
HttpOpenRequestA
InternetReadFile
HttpEndRequestA
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpSendRequestExA
HttpAddRequestHeadersA
InternetSetOptionA
HttpQueryInfoA
InternetWriteFile
Sections
.text Size: 493KB - Virtual size: 492KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 489KB - Virtual size: 488KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ