Analysis
- max time kernel
670s - max time network
735s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
26/01/2023, 16:47
General
- Target LDPlayer9_es_1009_ld.exe
- Size 3.6MB
- Sample230126-vav7zaed88
- SHA256 08fee35f2462f93c96751755ff42f2f63525ad04e21543efe52a159c800ab80a
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
ds.dll
ds.dll
ds.dll
memory/4988-135-0x0000000072DB0000-0x0000000072DC4000-memory.dmp
memory/4988-136-0x0000000008B00000-0x00000000090A4000-memory.dmp
memory/4988-137-0x00000000085F0000-0x0000000008682000-memory.dmp
memory/4988-138-0x0000000009390000-0x000000000942C000-memory.dmp
memory/4988-139-0x0000000009430000-0x0000000009496000-memory.dmp
memory/4988-140-0x00000000099D0000-0x0000000009EFC000-memory.dmp