golddragon | 2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4

Analysis

Target

2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4.dll
Size

88KB
MD5

5a6d034b9f656bd60cc29688d2eba618
SHA1

83706ddaa5ea5ee2cfff54b7c809458a39163a7a
SHA256

2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4
SHA512

525a2cb4470e1a24bd2ed99df352565bee3f95124cb4221244d943fe99a65738991f037fcdf7040d1a76b6b9f96bf14674e196e7411666161f4e5ebe333e1b01

Score

10^/10

GoldDragon
GoldDragon is a second-stage backdoor attributed to Kimsuky.
backdoor golddragon

Blocklisted process makes network request 2 IoCs

flow	pid	Process
5	1100	rundll32.exe
6	1100	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1100	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	rundll32.exe
Token: SeDebugPrivilege	1100	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 956 wrote to memory of 1100	956	rundll32.exe	27
PID 956 wrote to memory of 1100	956	rundll32.exe	27
PID 956 wrote to memory of 1100	956	rundll32.exe	27
PID 956 wrote to memory of 1100	956	rundll32.exe	27
PID 956 wrote to memory of 1100	956	rundll32.exe	27
PID 956 wrote to memory of 1100	956	rundll32.exe	27
PID 956 wrote to memory of 1100	956	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:956
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1100

memory/1100-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmp

Filesize
8KB

Download