Analyzing Gold Dragon As part of its initialization, Gold Dragon:  Builds its imports by dynamically loading multiple APIs from multiple libraries Gains debug privileges (“SeDebugPrivilege”) for its own process to read remote memory residing in other processes  The malware does not establish persistence for itself but for another component (if it is found) on the system:  The malware begins by looking for an instance of the Hangul word processor (HWP) running on the system