Static task
static1
Behavioral task
behavioral1
Sample
LPDragoon.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
LPDragoon.dll
Resource
win10v2004-20220901-en
General
-
Target
afe94213c6e32cc397c5d011f827fdd689a3f39d10874d921f2295ace26ff341
-
Size
818KB
-
MD5
fc7a386a850fb17297371b9e0941a4f6
-
SHA1
596ca7eba8ba5e3dbaafcec3cfff4fbc2a0063d4
-
SHA256
afe94213c6e32cc397c5d011f827fdd689a3f39d10874d921f2295ace26ff341
-
SHA512
b4cfa048bc1192ff3a59e5404a5ac251ea2358721f0d22b84d68d8a89faf7e369d23a03cbf90e50721447f5a685fd818899591961e25f3683053d1d07c8a7ca1
-
SSDEEP
12288:aQECXbI6uVlv+R2Ad8EIn1xQQhHqUqUc3+a5QYxvBjbFZK9laHzc+Lsx:agtWlvVfn1x3FqB53cM1FIez1LU
Malware Config
Signatures
Files
-
afe94213c6e32cc397c5d011f827fdd689a3f39d10874d921f2295ace26ff341.zip
-
LPDragoon.dll.dll windows x86
5543674072ea32fe47a0620533af299b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
GetVersionExA
CreateMutexA
LoadLibraryExA
MapViewOfFile
UnmapViewOfFile
LocalAlloc
CreateProcessA
SetFileAttributesA
ExpandEnvironmentStringsA
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcessId
FindResourceA
LoadResource
SizeofResource
LockResource
FreeResource
WriteFile
GetTempPathA
GetTempFileNameA
OpenFileMappingA
DeleteCriticalSection
WaitForSingleObject
ReleaseMutex
GetSystemDirectoryA
MoveFileExA
GetCurrentProcess
VirtualAlloc
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineA
VirtualFree
IsBadReadPtr
VirtualProtect
SetFilePointer
SetFileTime
ReadFile
CreateDirectoryA
LocalFileTimeToFileTime
VirtualQuery
CreateThread
InitializeCriticalSectionAndSpinCount
Sleep
RaiseException
GetCurrentThreadId
ExitProcess
GetFileSize
MapViewOfFileEx
CreateFileMappingW
GetModuleHandleW
MoveFileA
EnterCriticalSection
SetLastError
LocalFree
GetPrivateProfileSectionA
GetTickCount
GetModuleFileNameA
GetModuleHandleA
GetFileAttributesA
CloseHandle
CreateFileA
GetProcAddress
LoadLibraryA
FreeLibrary
OutputDebugStringA
SystemTimeToFileTime
GetLocalTime
DeleteFileA
GetLastError
InitializeCriticalSection
LeaveCriticalSection
GetCurrentDirectoryA
CreateFileW
SetEndOfFile
FlushFileBuffers
SetStdHandle
WriteConsoleW
HeapSize
LoadLibraryW
GetStringTypeW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetStartupInfoW
GetFileType
SetHandleCount
LCMapStringW
GetConsoleMode
GetConsoleCP
RtlUnwind
GetModuleFileNameW
GetStdHandle
HeapDestroy
HeapCreate
IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
GetSystemTimeAsFileTime
HeapReAlloc
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
CompareStringW
advapi32
RegQueryValueExA
SetSecurityDescriptorDacl
GetLengthSid
InitializeSecurityDescriptor
ControlService
StartServiceA
DeleteService
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
FreeSid
AddAccessAllowedAce
InitializeAcl
AllocateAndInitializeSid
AdjustTokenPrivileges
LookupPrivilegeValueA
SetEntriesInAclA
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
shell32
ord51
ShellExecuteA
SHGetSpecialFolderPathA
ord165
ole32
CoReleaseServerProcess
CoAddRefServerProcess
CoCreateInstance
shlwapi
SHDeleteKeyA
PathIsDirectoryA
PathAddBackslashA
PathFileExistsA
PathRemoveFileSpecA
wininet
FindCloseUrlCache
DeleteUrlCacheEntry
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Sections
.text Size: 138KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ