Overview
overview
7Static
static
7dragonsetup.exe
windows11-21h2-x64
7$PLUGINSDI...in.dll
windows11-21h2-x64
1$PLUGINSDI...ns.dll
windows11-21h2-x64
3$PLUGINSDI...in.dll
windows11-21h2-x64
$PLUGINSDI...in.dll
windows11-21h2-x64
1$PLUGINSDI...ls.dll
windows11-21h2-x64
7$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...se.rtf
windows11-21h2-x64
1$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...gs.dll
windows11-21h2-x64
3$PLUGINSDI...ON.dll
windows11-21h2-x64
7$PLUGINSDI...it.dll
windows11-21h2-x64
7$PLUGINSDI...dl.dll
windows11-21h2-x64
3$PLUGINSDI...on.dll
windows11-21h2-x64
7WidevineCd...dm.dll
windows11-21h2-x64
1bundles/cc...er.exe
windows11-21h2-x64
6chrome_elf.dll
windows11-21h2-x64
1d3dcompiler_47.dll
windows11-21h2-x64
3dragon.exe
windows11-21h2-x64
7dragon_install.exe
windows11-21h2-x64
1dragon_register.exe
windows11-21h2-x64
1dragon_s.dll
windows11-21h2-x64
3dragon_updater.exe
windows11-21h2-x64
1elevation_service.exe
windows11-21h2-x64
1libEGL.dll
windows11-21h2-x64
1libGLESv2.dll
windows11-21h2-x64
3locales/dr...ll.exe
windows11-21h2-x64
1locales/dr...er.exe
windows11-21h2-x64
1modules/coresys32.dll
windows11-21h2-x64
3modules/dr...er.exe
windows11-21h2-x64
1modules/dr...il.dll
windows11-21h2-x64
3mojo_core.dll
windows11-21h2-x64
1Analysis
-
max time kernel
134s -
max time network
274s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-04-2024 19:36
Behavioral task
behavioral1
Sample
dragonsetup.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallHelperPlugin.dll
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/NSIS_SkinCrafter_Plugin.dll
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SecureDNSPlugin.dll
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/license.rtf
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/linker.dll
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsRichEdit.dll
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/version.dll
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
WidevineCdm/_platform_specific/win_x86/widevinecdm.dll
Resource
win11-20240412-en
Behavioral task
behavioral16
Sample
bundles/ccav_installer.exe
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
chrome_elf.dll
Resource
win11-20240412-en
Behavioral task
behavioral18
Sample
d3dcompiler_47.dll
Resource
win11-20240412-en
Behavioral task
behavioral19
Sample
dragon.exe
Resource
win11-20240412-en
Behavioral task
behavioral20
Sample
dragon_install.exe
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
dragon_register.exe
Resource
win11-20240412-en
Behavioral task
behavioral22
Sample
dragon_s.dll
Resource
win11-20240412-en
Behavioral task
behavioral23
Sample
dragon_updater.exe
Resource
win11-20240412-en
Behavioral task
behavioral24
Sample
elevation_service.exe
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
libEGL.dll
Resource
win11-20240412-en
Behavioral task
behavioral26
Sample
libGLESv2.dll
Resource
win11-20240412-en
Behavioral task
behavioral27
Sample
locales/dragon_install.exe
Resource
win11-20240412-en
Behavioral task
behavioral28
Sample
locales/dragon_register.exe
Resource
win11-20240412-en
Behavioral task
behavioral29
Sample
modules/coresys32.dll
Resource
win11-20240412-en
Behavioral task
behavioral30
Sample
modules/dragon_helper.exe
Resource
win11-20240412-en
Behavioral task
behavioral31
Sample
modules/dragon_util.dll
Resource
win11-20240412-en
Behavioral task
behavioral32
Sample
mojo_core.dll
Resource
win11-20240412-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
15KB
-
MD5
033ee34c40e8fa85bf2739bcb2f3e186
-
SHA1
2ca942f35f77f37df3fc6097acac34f2e77341b7
-
SHA256
c91c1796338a265b49039c0b2c7a312d764b99e5174fb2dae455ca54f8f41ec7
-
SHA512
2204e0b8721b8d85c51bd068b1695b16ee096bfc1d1cd5843f48fd04032aeee2b6a91ce82978a4b3414f3d966ec5b36fb337a4149dae3a1d0445935d964d247f
-
SSDEEP
384:ErC43tPegZ3eBaRwCPOYY7nNYXCT/Yosa:EmTgZ3eBTCmrnNAh
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4456 936 WerFault.exe 81 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4700 wrote to memory of 936 4700 rundll32.exe 81 PID 4700 wrote to memory of 936 4700 rundll32.exe 81 PID 4700 wrote to memory of 936 4700 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵PID:936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 936 -s 5443⤵
- Program crash
PID:4456
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 936 -ip 9361⤵PID:3724