08fee35f2462f93c96751755ff42f2f63525ad04e21543efe52a159c800ab80a

Resubmissions

26-01-2023 16:47

230126-vav7zaed88 10

Analysis

max time kernel
670s
max time network
735s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2023 16:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LDPlayer9_es_1009_ld.exe
Size

3.6MB
MD5

90276982cc921f646f74f8310ef8cd6a
SHA1

37d5ff4e70485bbcc6e4ef6fa08d3b7839012d0f
SHA256

08fee35f2462f93c96751755ff42f2f63525ad04e21543efe52a159c800ab80a
SHA512

bdbdb26aaae5b84e7c8298e5e6033142f872e8f25578274c3a8c8fdc7d1e07033be62760b5230a67696bf9f4d885a7187d17680b271e713f1f1a111fa37edf2c
SSDEEP

49152:KpiUPlcfO74zHK+1ULjFvnxe2T9g4tGOPf28xuYT:KpPNcG74r1ULxvxew9g1op

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

LDPlayer9_es_1009_ld.exe

pid process

4988 LDPlayer9_es_1009_ld.exe
4988 LDPlayer9_es_1009_ld.exe
4988 LDPlayer9_es_1009_ld.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

LDPlayer9_es_1009_ld.exe

pid	process
4988	LDPlayer9_es_1009_ld.exe
4988	LDPlayer9_es_1009_ld.exe
4988	LDPlayer9_es_1009_ld.exe
4988	LDPlayer9_es_1009_ld.exe
4988	LDPlayer9_es_1009_ld.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

LDPlayer9_es_1009_ld.exe

description	pid	process
Token: SeDebugPrivilege	4988	LDPlayer9_es_1009_ld.exe
Token: SeShutdownPrivilege	4988	LDPlayer9_es_1009_ld.exe
Token: SeCreatePagefilePrivilege	4988	LDPlayer9_es_1009_ld.exe

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4988

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Filesize
62KB

MD5
2204cba332566d808353f256bd211595

SHA1
8da4d578601335c86a3c0b432d37011da316b6cc

SHA256
305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e

SHA512
ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Filesize
62KB

MD5
2204cba332566d808353f256bd211595

SHA1
8da4d578601335c86a3c0b432d37011da316b6cc

SHA256
305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e

SHA512
ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll
Filesize
62KB

MD5
2204cba332566d808353f256bd211595

SHA1
8da4d578601335c86a3c0b432d37011da316b6cc

SHA256
305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e

SHA512
ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a

Download Submit
memory/4988-135-0x0000000072DB0000-0x0000000072DC4000-memory.dmp

Filesize
80KB

Download
memory/4988-136-0x0000000008B00000-0x00000000090A4000-memory.dmp

Filesize
5.6MB

Download
memory/4988-137-0x00000000085F0000-0x0000000008682000-memory.dmp

Filesize
584KB

Download
memory/4988-138-0x0000000009390000-0x000000000942C000-memory.dmp

Filesize
624KB

Download
memory/4988-139-0x0000000009430000-0x0000000009496000-memory.dmp

Filesize
408KB

Download
memory/4988-140-0x00000000099D0000-0x0000000009EFC000-memory.dmp

Filesize
5.2MB

Download