golddragon | fa85ed7118f1f8ac656a03958ac7b973bb747a6e8f86561d071ad05255f4e9f0

Target

1.dll
Size

805KB
MD5

25c5240491accd78c6ee10efb1b73984
SHA1

6072927d9641237c609dd9b604e1d0180a908f3c
SHA256

fa85ed7118f1f8ac656a03958ac7b973bb747a6e8f86561d071ad05255f4e9f0
SHA512

d967b39d07a79a255c2f4ebd71e3ba0e2748c50b70bdfcf88486837e11cdb44919945dd072e9f5537e3d6818bef28d9e6799ff227909bcbdabd6639314142eb0

Score

10^/10

golddragon backdoor persistence spyware stealer

Malware Config

Signatures

GoldDragon
GoldDragon is a second-stage backdoor attributed to Kimsuky.
backdoor golddragon

GoldDragon 2021 Stage1 backdoor 4 IoCs

Detect GoldDragon backdoor Stage 1.

backdoor

resource	yara_rule
behavioral1/memory/1700-56-0x0000000010000000-0x00000000101E7000-memory.dmp	golddragon_stage1
behavioral1/memory/1700-62-0x0000000010000000-0x00000000101E7000-memory.dmp	golddragon_stage1
behavioral1/memory/1700-63-0x0000000010000000-0x00000000101E7000-memory.dmp	golddragon_stage1
behavioral1/memory/1700-71-0x0000000010000000-0x00000000101E7000-memory.dmp	golddragon_stage1

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	regedit.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	regedit.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\schedule = "rundll32.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\exts\\hancom.dll\" Run"	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1700	rundll32.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1700 set thread context of 940	1700	rundll32.exe	44

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
1864	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Component Information	regedit.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	regedit.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data	regedit.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture	regedit.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\PreferredProfile	regedit.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities	regedit.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
680	ipconfig.exe
584	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
1932	systeminfo.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2044	taskkill.exe

Runs regedit.exe 1 IoCs

pid	Process
1400	regedit.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1580	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1400	regedit.exe
940	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2044	taskkill.exe
Token: SeDebugPrivilege	1864	tasklist.exe
Token: SeDebugPrivilege	584	NETSTAT.EXE
Token: SeDebugPrivilege	1580	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1700	1960	rundll32.exe	28
PID 1960 wrote to memory of 1700	1960	rundll32.exe	28
PID 1960 wrote to memory of 1700	1960	rundll32.exe	28
PID 1960 wrote to memory of 1700	1960	rundll32.exe	28
PID 1960 wrote to memory of 1700	1960	rundll32.exe	28
PID 1960 wrote to memory of 1700	1960	rundll32.exe	28
PID 1960 wrote to memory of 1700	1960	rundll32.exe	28
PID 1700 wrote to memory of 1924	1700	rundll32.exe	29
PID 1700 wrote to memory of 1924	1700	rundll32.exe	29
PID 1700 wrote to memory of 1924	1700	rundll32.exe	29
PID 1700 wrote to memory of 1924	1700	rundll32.exe	29
PID 1924 wrote to memory of 2044	1924	cmd.exe	31
PID 1924 wrote to memory of 2044	1924	cmd.exe	31
PID 1924 wrote to memory of 2044	1924	cmd.exe	31
PID 1924 wrote to memory of 2044	1924	cmd.exe	31
PID 1700 wrote to memory of 1820	1700	rundll32.exe	33
PID 1700 wrote to memory of 1820	1700	rundll32.exe	33
PID 1700 wrote to memory of 1820	1700	rundll32.exe	33
PID 1700 wrote to memory of 1820	1700	rundll32.exe	33
PID 1820 wrote to memory of 680	1820	cmd.exe	35
PID 1820 wrote to memory of 680	1820	cmd.exe	35
PID 1820 wrote to memory of 680	1820	cmd.exe	35
PID 1820 wrote to memory of 680	1820	cmd.exe	35
PID 1820 wrote to memory of 1092	1820	cmd.exe	36
PID 1820 wrote to memory of 1092	1820	cmd.exe	36
PID 1820 wrote to memory of 1092	1820	cmd.exe	36
PID 1820 wrote to memory of 1092	1820	cmd.exe	36
PID 1700 wrote to memory of 1432	1700	rundll32.exe	37
PID 1700 wrote to memory of 1432	1700	rundll32.exe	37
PID 1700 wrote to memory of 1432	1700	rundll32.exe	37
PID 1700 wrote to memory of 1432	1700	rundll32.exe	37
PID 1432 wrote to memory of 1932	1432	cmd.exe	39
PID 1432 wrote to memory of 1932	1432	cmd.exe	39
PID 1432 wrote to memory of 1932	1432	cmd.exe	39
PID 1432 wrote to memory of 1932	1432	cmd.exe	39
PID 1700 wrote to memory of 572	1700	rundll32.exe	41
PID 1700 wrote to memory of 572	1700	rundll32.exe	41
PID 1700 wrote to memory of 572	1700	rundll32.exe	41
PID 1700 wrote to memory of 572	1700	rundll32.exe	41
PID 572 wrote to memory of 1864	572	cmd.exe	43
PID 572 wrote to memory of 1864	572	cmd.exe	43
PID 572 wrote to memory of 1864	572	cmd.exe	43
PID 572 wrote to memory of 1864	572	cmd.exe	43
PID 1700 wrote to memory of 940	1700	rundll32.exe	44
PID 1700 wrote to memory of 940	1700	rundll32.exe	44
PID 1700 wrote to memory of 940	1700	rundll32.exe	44
PID 1700 wrote to memory of 940	1700	rundll32.exe	44
PID 1700 wrote to memory of 940	1700	rundll32.exe	44
PID 1700 wrote to memory of 940	1700	rundll32.exe	44
PID 940 wrote to memory of 1712	940	svchost.exe	45
PID 940 wrote to memory of 1712	940	svchost.exe	45
PID 940 wrote to memory of 1712	940	svchost.exe	45
PID 940 wrote to memory of 1712	940	svchost.exe	45
PID 1712 wrote to memory of 584	1712	cmd.exe	47
PID 1712 wrote to memory of 584	1712	cmd.exe	47
PID 1712 wrote to memory of 584	1712	cmd.exe	47
PID 1712 wrote to memory of 584	1712	cmd.exe	47

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1.dll,#1
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im daumcleaner.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im daumcleaner.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2044
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c ipconfig/all >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat" & arp -a >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:680
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c systeminfo >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c tasklist >>"C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:1864
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c netstat -a >> "C:\Users\Admin\AppData\Roaming\wininit.db"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1712
    - - C:\Windows\SysWOW64\NETSTAT.EXE
        
        netstat -a
        5⤵
        Gathers network information
        Suspicious use of AdjustPrivilegeToken
        
        PID:584

C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat

Filesize
1KB

MD5
4ee7e79871bb172fb9479cb639b45cb4

SHA1
4184e5802987a93b2e29ba5b371c693a7890cab9

SHA256
6d398f3f4c4ff74b3ddb6bb9ab229fd815481b462cd98752a1e163eb1e307c98

SHA512
509fa39ce2ca53d08fefd796838c360b8e7b72f6a8e0b1f35b0d881680d739735f829026912714a0304eecb87f1d0dabf9b3cb8c2fe6476e9835a1fbecf62a9c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\pubs\PI_001.dat

Filesize
3KB

MD5
b4da21e8abddd8be6720044b344b39cb

SHA1
e8095072047e12f235477a7937595ede8361b590

SHA256
29938aae27cfe346d88c289cb05dc74e0a4c91642d57b708b51d811e01487fa1

SHA512
b533fe2575f3065e51c5d9c7fcfbf7d80e94dfe5cc2535a442c3894b76655c64733b1a48e76f31abcf2d46b62d987251fd81cf81dbecb64f634b657303e65fde

Download Submit
C:\Users\Admin\AppData\Roaming\wininit.db

Filesize
2KB

MD5
bad2027ed9968425bc952f2a372125c5

SHA1
94aa1c1de02a0a16248bf09d891d8f6854d3d8b9

SHA256
8ddb408159d92f1d0edfc0d70063f9cfb772a3385cff9a91c993947ec2fe7a94

SHA512
6de5cb42187608ca7a8a99460f00af5f3bc30fdf480f28fd570b03791f17596fd9b6a3494c801a1f7deb8fe18fe5489ae123d6e80558c9525fe90bb7ea41e488

Download Submit
memory/940-77-0x0000000000080000-0x00000000000DA000-memory.dmp

Filesize
360KB

Download
memory/940-81-0x0000000000080000-0x00000000000DA000-memory.dmp

Filesize
360KB

Download
memory/940-82-0x0000000000080000-0x00000000000DA000-memory.dmp

Filesize
360KB

Download
memory/940-75-0x0000000000080000-0x00000000000DA000-memory.dmp

Filesize
360KB

Download
memory/940-90-0x0000000000080000-0x00000000000DA000-memory.dmp

Filesize
360KB

Download
memory/1580-85-0x000007FEFC221000-0x000007FEFC223000-memory.dmp

Filesize
8KB

Download
memory/1580-91-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/1580-95-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/1580-94-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/1580-92-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/1580-88-0x00000000024A4000-0x00000000024A7000-memory.dmp

Filesize
12KB

Download
memory/1580-89-0x00000000024AB000-0x00000000024CA000-memory.dmp

Filesize
124KB

Download
memory/1580-87-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp

Filesize
11.4MB

Download
memory/1580-86-0x000007FEF3C90000-0x000007FEF46B3000-memory.dmp

Filesize
10.1MB

Download
memory/1700-62-0x0000000010000000-0x00000000101E7000-memory.dmp

Filesize
1.9MB

Download
memory/1700-63-0x0000000010000000-0x00000000101E7000-memory.dmp

Filesize
1.9MB

Download
memory/1700-56-0x0000000010000000-0x00000000101E7000-memory.dmp

Filesize
1.9MB

Download
memory/1700-71-0x0000000010000000-0x00000000101E7000-memory.dmp

Filesize
1.9MB

Download
memory/1700-55-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download