golddragon | 873b8fb97b4b0c6d7992f6af15653295788526def41f337c651dc64e8e4aeebd

Analysis

max time kernel
135s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
12-04-2023 01:49

Target

2c530adb841114366ce6177ce964a5e6.dll
Size

223KB
MD5

2c530adb841114366ce6177ce964a5e6
SHA1

5b69e3e5f4f49cf8b635a57a8c92e17a4f130d50
SHA256

873b8fb97b4b0c6d7992f6af15653295788526def41f337c651dc64e8e4aeebd
SHA512

002ba1e7b6a1a250678bfe63ae8de106606bc540ab10d69abdb0b4f87e72c79f91cc7890f6e649226cef9d2fec3f5c5176c254e726ce6eaf3dc9d73b12408c65
SSDEEP

6144:8L7OMNsdhZlmRDbwE0GCT7rxrvxWYcJM/x:8+M2djEJQr1Y7

Score

10^/10

GoldDragon
GoldDragon is a second-stage backdoor attributed to Kimsuky.
backdoor golddragon

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1900 set thread context of 4976	1900	rundll32.exe	86

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 1900	4860	rundll32.exe	85
PID 4860 wrote to memory of 1900	4860	rundll32.exe	85
PID 4860 wrote to memory of 1900	4860	rundll32.exe	85
PID 1900 wrote to memory of 4976	1900	rundll32.exe	86
PID 1900 wrote to memory of 4976	1900	rundll32.exe	86
PID 1900 wrote to memory of 4976	1900	rundll32.exe	86
PID 1900 wrote to memory of 4976	1900	rundll32.exe	86
PID 1900 wrote to memory of 4976	1900	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c530adb841114366ce6177ce964a5e6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c530adb841114366ce6177ce964a5e6.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:4976

memory/4976-133-0x0000000000A00000-0x0000000000A24000-memory.dmp

Filesize
144KB

Download