Analysis
- max time kernel
139s - max time network
115s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
09/08/2024, 15:57
General
- Target LDPlayer9_ens_com.supercell.brawlstars_25567197_ld.exe
- Size 3.4MB
- Sample240809-td7jqsselk
- SHA256 8d48d0a05d581922a4d30ba98cbf51ea981a37c95fad689e0b84b979e312f6a4
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Loads dropped DLL 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.supercell.brawlstars_25567197_ld.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_com.supercell.brawlstars_25567197_ld.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ds.dll
memory/4044-12-0x0000000006770000-0x0000000006780000-memory.dmp
memory/4044-13-0x000000007231E000-0x000000007231F000-memory.dmp
memory/4044-17-0x0000000006C20000-0x0000000006C36000-memory.dmp
memory/4044-18-0x0000000072BC0000-0x0000000072BD6000-memory.dmp
memory/4044-20-0x0000000009370000-0x0000000009914000-memory.dmp
memory/4044-21-0x0000000008ED0000-0x0000000008F62000-memory.dmp
memory/4044-33-0x0000000002F50000-0x0000000002F94000-memory.dmp
memory/4044-34-0x0000000009D20000-0x0000000009DBC000-memory.dmp
memory/4044-35-0x0000000003020000-0x0000000003086000-memory.dmp
memory/4044-36-0x000000000A450000-0x000000000A97C000-memory.dmp
memory/4044-37-0x0000000006770000-0x0000000006780000-memory.dmp
memory/4044-38-0x000000007231E000-0x000000007231F000-memory.dmp