Skip to content

S0637 NativeZone

NativeZone is the name given collectively to disposable custom Cobalt Strike loaders used by APT29 since at least 2021.12

Item Value
ID S0637
Associated Names
Version 1.0
Created 04 August 2021
Last Modified 16 October 2021
Navigation Layer View In ATT&CK® Navigator

Techniques Used

Domain ID Name Use
enterprise T1140 Deobfuscate/Decode Files or Information NativeZone can decrypt and decode embedded Cobalt Strike beacon stage shellcode.1
enterprise T1480 Execution Guardrails NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware’s components.12
enterprise T1036 Masquerading NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.2
enterprise T1218 System Binary Proxy Execution -
enterprise T1218.011 Rundll32 NativeZone has used rundll32 to execute a malicious DLL.2
enterprise T1204 User Execution -
enterprise T1204.002 Malicious File NativeZone can display an RTF document to the user to enable execution of Cobalt Strike stage shellcode.1
enterprise T1497 Virtualization/Sandbox Evasion -
enterprise T1497.001 System Checks NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.1

Groups That Use This Software

ID Name References
G0016 APT29 2