Gold Dragon
Gold Dragon is a Korean-language, data gathering implant that was first observed in the wild in South Korea in July 2017. Gold Dragon was used along with Brave Prince and RunningRAT in operations targeting organizations associated with the 2018 Pyeongchang Winter Olympics. [1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
Gold Dragon establishes persistence in the Startup folder.[1] |
| Enterprise | T1059 | .003 | 命令与脚本解释器: Windows Command Shell |
Gold Dragon uses cmd.exe to execute commands for discovery.[1] |
| Enterprise | T1562 | .001 | 妨碍防御: Disable or Modify Tools |
Gold Dragon terminates anti-malware processes if they’re found running on the system.[1] |
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols |
Gold Dragon uses HTTP for communication to the control servers.[1] |
| Enterprise | T1560 | 归档收集数据 |
Gold Dragon encrypts data using Base64 before being sent to the command and control server.[1] |
|
| Enterprise | T1074 | .001 | 数据分段: Local Data Staging |
Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.[1] |
| Enterprise | T1083 | 文件和目录发现 |
Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.[1] |
|
| Enterprise | T1012 | 查询注册表 |
Gold Dragon enumerates registry keys with the command |
|
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.[1] |
| Enterprise | T1082 | 系统信息发现 |
Gold Dragon collects endpoint information using the |
|
| Enterprise | T1033 | 系统所有者/用户发现 |
Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.[1] |
|
| Enterprise | T1518 | .001 | 软件发现: Security Software Discovery |
Gold Dragon checks for anti-malware products and processes.[1] |
| Enterprise | T1105 | 输入工具传输 |
Gold Dragon can download additional components from the C2 server.[1] |
|
| Enterprise | T1057 | 进程发现 |
Gold Dragon checks the running processes on the victim’s machine.[1] |
|
Groups That Use This Software
References
- Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
- An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.