golddragon | 2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4

Analysis

Target

2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4.dll
Size

88KB
MD5

5a6d034b9f656bd60cc29688d2eba618
SHA1

83706ddaa5ea5ee2cfff54b7c809458a39163a7a
SHA256

2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4
SHA512

525a2cb4470e1a24bd2ed99df352565bee3f95124cb4221244d943fe99a65738991f037fcdf7040d1a76b6b9f96bf14674e196e7411666161f4e5ebe333e1b01

Score

10^/10

GoldDragon
GoldDragon is a second-stage backdoor attributed to Kimsuky.
backdoor golddragon

Blocklisted process makes network request 2 IoCs

flow	pid	Process
34	3580	rundll32.exe
35	3580	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3580	rundll32.exe
3580	rundll32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3580	rundll32.exe
Token: SeDebugPrivilege	3580	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 3580	2800	rundll32.exe	69
PID 2800 wrote to memory of 3580	2800	rundll32.exe	69
PID 2800 wrote to memory of 3580	2800	rundll32.exe	69

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2df9e274ce0e71964aca4183cec01fb63566a907981a9e7384c0d73f86578fe4.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3580