Static task
static1
Behavioral task
behavioral1
Sample
LPDragoon.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
LPDragoon.dll
Resource
win10v2004-20221111-en
General
-
Target
5f56bab42b8006eb9cda228ea0765b9f4657a1c11ba60ceae3d13d8e8a68cfe4
-
Size
630KB
-
MD5
ac14cc8e4d8db601c4409fa5f0fbb392
-
SHA1
0f459d19571cb1faa440a140149a57418d180e9d
-
SHA256
5f56bab42b8006eb9cda228ea0765b9f4657a1c11ba60ceae3d13d8e8a68cfe4
-
SHA512
acf3a5e12089048647ca3fdafebca38494bf8a7ff15bd4d88dcbbf0c3af6c9d574e03efc81729b0d04e63ed715be28430197087f2abec5134b9395bf1fe11354
-
SSDEEP
12288:AT2YI32SRb/NY75SqCQ4S1FtQLwSxTZeu6Gs4cCgRBMcdEiJBesyPBwfPiO9:u2Y1SRrO5SQvFiXbKGs4cCgrstJsf9
Malware Config
Signatures
Files
-
5f56bab42b8006eb9cda228ea0765b9f4657a1c11ba60ceae3d13d8e8a68cfe4.zip
-
LPDragoon.dll.dll windows x86
dd2444a00fd7b56fd9bcc5958a8c93cf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateMutexA
MapViewOfFile
UnmapViewOfFile
LocalAlloc
SetFileAttributesA
ExpandEnvironmentStringsA
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcessId
FindResourceA
LoadResource
SizeofResource
LockResource
FreeResource
WriteFile
GetTempPathA
GetTempFileNameA
OpenFileMappingA
GetVersionExA
DeleteCriticalSection
WaitForSingleObject
EnterCriticalSection
ReleaseMutex
LeaveCriticalSection
GetCurrentDirectoryA
GetSystemDirectoryA
CopyFileA
MoveFileExA
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
VirtualFree
IsBadReadPtr
VirtualProtect
SetFilePointer
SetFileTime
ReadFile
CreateDirectoryA
LocalFileTimeToFileTime
VirtualQuery
CreateThread
InitializeCriticalSectionAndSpinCount
Sleep
RaiseException
GetCurrentThreadId
OutputDebugStringA
GetPrivateProfileSectionA
FindClose
FindNextFileA
FindFirstFileA
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
GetLocalTime
GetTickCount
GetModuleFileNameA
GetFileAttributesA
CreateFileA
DeleteFileA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
TerminateProcess
CloseHandle
GetCurrentProcess
SetLastError
LocalFree
GetLastError
InitializeCriticalSection
CreateFileW
SetEndOfFile
LoadLibraryW
HeapSize
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetStringTypeW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
IsProcessorFeaturePresent
GetModuleFileNameW
ExitProcess
GetStartupInfoW
GetSystemTimeAsFileTime
HeapReAlloc
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
LCMapStringW
RtlUnwind
GetConsoleCP
GetConsoleMode
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
CompareStringW
advapi32
SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
ControlService
StartServiceA
DeleteService
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
FreeSid
AddAccessAllowedAce
InitializeAcl
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
SetEntriesInAclA
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
shell32
ShellExecuteA
ole32
CoAddRefServerProcess
CoReleaseServerProcess
CoCreateInstance
shlwapi
SHDeleteKeyA
PathFileExistsA
PathAddBackslashA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
Sections
.text Size: 129KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ