goldenspy | 20932b2151de5f0dc5c1159fbc1d2d004f069bb04d32d66dc7fa5b7b9eac1aa7

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20220414-en
submitted
07-07-2022 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GoldenSpy (6).exe
Size

366KB
MD5

b363e855f613233848a0a89216488bfb
SHA1

c897972dfd26a07591cabbeeeeeb1db18f2f21d4
SHA256

20932b2151de5f0dc5c1159fbc1d2d004f069bb04d32d66dc7fa5b7b9eac1aa7
SHA512

47d65f9d64e2d9fd5fe78731d990dadb6148240477dc20ef9305ae5d32345ef2d28e82a10d40e2139141bf0c25556eb633b0c7cf1139989ec0bf0a610d6efeda

Score

10^/10

goldenspy backdoor discovery suricata trojan

Malware Config

Signatures

GoldenSpy
Backdoor spotted in June 2020 being distributed with the Chinese "Intelligent Tax" software.
trojan backdoor goldenspy

GoldenSpy Payload 8 IoCs

Processes:

resource	yara_rule
\Program Files (x86)\svm\svm.exe	goldenspy_svm_payload
C:\Program Files (x86)\svm\svm.exe	goldenspy_svm_payload
\Program Files (x86)\svm\svmm.exe	goldenspy_svm_payload
C:\Program Files (x86)\svm\svmm.exe	goldenspy_svm_payload
C:\Program Files (x86)\svm\svmm.exe	goldenspy_svm_payload
C:\Program Files (x86)\svm\svm.exe	goldenspy_svm_payload
C:\Program Files (x86)\svm\svm.exe	goldenspy_svm_payload
C:\Program Files (x86)\svm\svmm.exe	goldenspy_svm_payload

suricata: ET MALWARE GoldenSpy Domain Observed
suricata: ET MALWARE GoldenSpy Domain Observed
suricata
Executes dropped EXE 6 IoCs

Processes:

svm.exesvmm.exesvm.exesvmm.exesvm.exesvmm.exe

pid process

960 svm.exe
1768 svmm.exe
1604 svm.exe
1780 svmm.exe
676 svm.exe
1168 svmm.exe
Loads dropped DLL 4 IoCs

Processes:

GoldenSpy (6).exe

pid process

1800 GoldenSpy (6).exe
1800 GoldenSpy (6).exe
1800 GoldenSpy (6).exe
1800 GoldenSpy (6).exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
960	svm.exe
1768	svmm.exe
1604	svm.exe
1780	svmm.exe
676	svm.exe
1168	svmm.exe

Drops file in System32 directory 1 IoCs

Processes:

svm.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svm.exe

Drops file in Program Files directory 2 IoCs

Processes:

GoldenSpy (6).exesvm.exe

description	ioc	process
File created	C:\Program Files (x86)\svm\svm.exe	GoldenSpy (6).exe
File opened for modification	C:\Program Files (x86)\svm\log\20220707-svm.log	svm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

Processes:

svm.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svm.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0096000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svm.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svm.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{37C11BBE-0F4C-45E7-9D1E-433D6C488839}	svm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{37C11BBE-0F4C-45E7-9D1E-433D6C488839}\WpadDecisionReason = "1"	svm.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{37C11BBE-0F4C-45E7-9D1E-433D6C488839}\WpadDecisionTime = 1003b335e891d801	svm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{37C11BBE-0F4C-45E7-9D1E-433D6C488839}\WpadNetworkName = "Network 3"	svm.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-65-00-a1-95-90	svm.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{37C11BBE-0F4C-45E7-9D1E-433D6C488839}\WpadDecision = "0"	svm.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{37C11BBE-0F4C-45E7-9D1E-433D6C488839}\42-65-00-a1-95-90	svm.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-65-00-a1-95-90\WpadDecisionTime = 1003b335e891d801	svm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svm.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svm.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-65-00-a1-95-90\WpadDecisionReason = "1"	svm.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-65-00-a1-95-90\WpadDecision = "0"	svm.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

GoldenSpy (6).exesvmm.exesvm.exe

pid	process
1800	GoldenSpy (6).exe
1800	GoldenSpy (6).exe
1800	GoldenSpy (6).exe
1800	GoldenSpy (6).exe
1168	svmm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe
1168	svmm.exe
676	svm.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

GoldenSpy (6).exe

description	pid	process	target process
PID 1800 wrote to memory of 960	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 960	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 960	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 960	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 1768	1800	GoldenSpy (6).exe	svmm.exe
PID 1800 wrote to memory of 1768	1800	GoldenSpy (6).exe	svmm.exe
PID 1800 wrote to memory of 1768	1800	GoldenSpy (6).exe	svmm.exe
PID 1800 wrote to memory of 1768	1800	GoldenSpy (6).exe	svmm.exe
PID 1800 wrote to memory of 1604	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 1604	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 1604	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 1604	1800	GoldenSpy (6).exe	svm.exe
PID 1800 wrote to memory of 1780	1800	GoldenSpy (6).exe	svmm.exe
PID 1800 wrote to memory of 1780	1800	GoldenSpy (6).exe	svmm.exe
PID 1800 wrote to memory of 1780	1800	GoldenSpy (6).exe	svmm.exe
PID 1800 wrote to memory of 1780	1800	GoldenSpy (6).exe	svmm.exe

C:\Users\Admin\AppData\Local\Temp\GoldenSpy (6).exe
"C:\Users\Admin\AppData\Local\Temp\GoldenSpy (6).exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1800

C:\Program Files (x86)\svm\svm.exe
"C:\Program Files (x86)\svm\svm.exe" -i
2⤵
- Executes dropped EXE
PID:960

C:\Program Files (x86)\svm\svmm.exe
"C:\Program Files (x86)\svm\svmm.exe" -i
2⤵
- Executes dropped EXE
PID:1768

C:\Program Files (x86)\svm\svm.exe
"C:\Program Files (x86)\svm\svm.exe" -start
2⤵
- Executes dropped EXE
PID:1604

C:\Program Files (x86)\svm\svmm.exe
"C:\Program Files (x86)\svm\svmm.exe" -start
2⤵
- Executes dropped EXE
PID:1780

C:\Program Files (x86)\svm\svm.exe
"C:\Program Files (x86)\svm\svm.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:676

C:\Program Files (x86)\svm\svmm.exe
"C:\Program Files (x86)\svm\svmm.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1168

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\svm\svm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
C:\Program Files (x86)\svm\svm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
C:\Program Files (x86)\svm\svm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
C:\Program Files (x86)\svm\svmm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
C:\Program Files (x86)\svm\svmm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
C:\Program Files (x86)\svm\svmm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
\Program Files (x86)\svm\svm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
\Program Files (x86)\svm\svmm.exe
Filesize
504KB

MD5
cf640636f3d85586607c20813884ff4a

SHA1
484d2e4d31a0c0a5ce5a2b2525677baa277c8a2c

SHA256
d41081969a212dec0ca623d848fb51907d8cdb1cb7bd86e1354e3041052858fb

SHA512
a6d18abdac3742613786b36e96130deee771a80cdcde200ccdab71546219094e8f088f6a05125d5f0056d9689265296783a59d49a88bc89bdd64073590f7f4a5

Download Submit
\Users\Admin\AppData\Local\Temp\nst1E9A.tmp\processwork.dll
Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
\Users\Admin\AppData\Local\Temp\nst1E9A.tmp\processwork.dll
Filesize
231KB

MD5
0a4fa7a9ba969a805eb0603c7cfe3378

SHA1
0f018a8d5b42c6ce8bf34b4a6422861c327af88c

SHA256
27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c

SHA512
e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178

Download Submit
memory/960-60-0x0000000000000000-mapping.dmp

Download
memory/1604-65-0x0000000000000000-mapping.dmp

Download
memory/1768-63-0x0000000000000000-mapping.dmp

Download
memory/1780-67-0x0000000000000000-mapping.dmp

Download
memory/1800-54-0x0000000075C71000-0x0000000075C73000-memory.dmp

Filesize
8KB

Download
memory/1800-56-0x0000000001F00000-0x0000000001F41000-memory.dmp

Filesize
260KB

Download