(Palo Alto) The malware in question is configured with the following three exported functions: • ServiceMain • Rundll32Call • DllEntryPoint The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2022-07-18 by Unit 42 from Palo Alto Networks Unit 42
2020-01-29 by nao_sec from nao_sec blog
2020 by SecureWorks from Secureworks
2019-12-17 by Jen Miller-Osborn from Palo Alto Networks Unit 42
2018-06-26 by Brittany Ash from Palo Alto Networks Unit 42
Tool: DDKONG
Names: DDKONG
Description: (Palo Alto) The malware in question is configured with the following three exported functions: • ServiceMain • Rundll32Call • DllEntryPoint The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time.
Category: Malware
Type: Backdoor
Mitre-attack: https://attack.mitre.org/software/S0255/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.ddkong
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:DDKONG
Last-card-change: 2020-04-23
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1218.011 SYSTEM BINARY PROXY EXECUTION : RUNDLL32 ddkong uses rundll32 to ensure only a single instance of itself is running at once. |