08fee35f2462f93c96751755ff42f2f63525ad04e21543efe52a159c800ab80a

Analysis

max time kernel
144s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
23-03-2023 22:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LDPlayer9_es_1009_ld.exe
Size

3.6MB
MD5

90276982cc921f646f74f8310ef8cd6a
SHA1

37d5ff4e70485bbcc6e4ef6fa08d3b7839012d0f
SHA256

08fee35f2462f93c96751755ff42f2f63525ad04e21543efe52a159c800ab80a
SHA512

bdbdb26aaae5b84e7c8298e5e6033142f872e8f25578274c3a8c8fdc7d1e07033be62760b5230a67696bf9f4d885a7187d17680b271e713f1f1a111fa37edf2c
SSDEEP

49152:KpiUPlcfO74zHK+1ULjFvnxe2T9g4tGOPf28xuYT:KpPNcG74r1ULxvxew9g1op

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
624	LDPlayer9_es_1009_ld.exe
624	LDPlayer9_es_1009_ld.exe
624	LDPlayer9_es_1009_ld.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
624	LDPlayer9_es_1009_ld.exe
624	LDPlayer9_es_1009_ld.exe
624	LDPlayer9_es_1009_ld.exe
624	LDPlayer9_es_1009_ld.exe
624	LDPlayer9_es_1009_ld.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	LDPlayer9_es_1009_ld.exe
Token: SeShutdownPrivilege	624	LDPlayer9_es_1009_ld.exe
Token: SeCreatePagefilePrivilege	624	LDPlayer9_es_1009_ld.exe

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll

Filesize
62KB

MD5
2204cba332566d808353f256bd211595

SHA1
8da4d578601335c86a3c0b432d37011da316b6cc

SHA256
305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e

SHA512
ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll

Filesize
62KB

MD5
2204cba332566d808353f256bd211595

SHA1
8da4d578601335c86a3c0b432d37011da316b6cc

SHA256
305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e

SHA512
ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll

Filesize
62KB

MD5
2204cba332566d808353f256bd211595

SHA1
8da4d578601335c86a3c0b432d37011da316b6cc

SHA256
305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e

SHA512
ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup\ds.dll

Filesize
62KB

MD5
2204cba332566d808353f256bd211595

SHA1
8da4d578601335c86a3c0b432d37011da316b6cc

SHA256
305c66014595e119140102a83fde0928b46902f7b5bd358cbfaf06145964ca3e

SHA512
ab58f9a6b6171a87eddddcfd11b49708269f33ab0f9f8406202eedb21c873aa2a38234f51f0b073ea84f7a182aff82b8e0596fb61400ffbc8d873fed7475fe7a

Download Submit
memory/624-148-0x0000000073490000-0x00000000734A4000-memory.dmp

Filesize
80KB

Download
memory/624-149-0x0000000005F60000-0x0000000005F70000-memory.dmp

Filesize
64KB

Download
memory/624-150-0x00000000088A0000-0x0000000008E44000-memory.dmp

Filesize
5.6MB

Download
memory/624-151-0x00000000083F0000-0x0000000008482000-memory.dmp

Filesize
584KB

Download
memory/624-152-0x00000000090F0000-0x000000000918C000-memory.dmp

Filesize
624KB

Download
memory/624-153-0x0000000009190000-0x00000000091F6000-memory.dmp

Filesize
408KB

Download
memory/624-154-0x0000000009730000-0x0000000009C5C000-memory.dmp

Filesize
5.2MB

Download
memory/624-155-0x0000000005F60000-0x0000000005F70000-memory.dmp

Filesize
64KB

Download