Analysis

  • max time kernel
    34s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14-08-2024 21:25

General

  • Target

    LDPlayer9_es_1009_ld.exe

  • Size

    3.4MB

  • MD5

    9f9bbd12ae5894046810e6736ec4d892

  • SHA1

    9e81b764a40ec39f6667c54b8d40da0b97cb5a7f

  • SHA256

    8d48d0a05d581922a4d30ba98cbf51ea981a37c95fad689e0b84b979e312f6a4

  • SHA512

    57d5b59de422394856e15b2d65c1f2a9e85a1b012c954ecad98682a84c7f90ff00be91819c8ae9cd123270e2cf446d69bfb248bde471a29846d57bf401417eaa

  • SSDEEP

    49152:p2XX9nMhH9mpVLZ0CSf1pHtOUYqP3CFOrtG/JR9sXafgkDFMVR9C1UhPJXMK701K:p2XX96HMpVLZo1t0xOoGBiCV2Hmd

Score
6/10

Malware Config

Signatures

  • Checks for any installed AV software in registry 1 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Loads dropped DLL 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe
    "C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"
    1⤵
    • Checks for any installed AV software in registry
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    619bcd34713b85ae91586aff286f7582

    SHA1

    be24a0b14beb9b09d773ce9e8bfa4963e6d299c6

    SHA256

    76df0def2ab42108d1be5ad1fb4379bb0406036e46103ada599bee1ace6d5cbc

    SHA512

    6b26eb2e5ad639c9f5527ea735bd3ce36006aa73e790a715bf236488fee973eb06b1281250a4099c97d0ea79c7936e77e12f2274138a8775357200d72679a1d0

  • C:\Users\Admin\AppData\Local\Temp\Cab321A.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar46E5.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • \Users\Admin\AppData\Local\Temp\Setup\ds.dll

    Filesize

    79KB

    MD5

    d9cb0b4a66458d85470ccf9b3575c0e7

    SHA1

    1572092be5489725cffbabe2f59eba094ee1d8a1

    SHA256

    6ab3fdc4038a86124e6d698620acba3abf9e854702490e245c840c096ee41d05

    SHA512

    94937e77da89181903a260eac5120e8db165f2a3493086523bc5abbe87c4a9da39af3ba1874e3407c52df6ffda29e4947062ba6abe9f05b85c42379c4be2e5e6

  • memory/2452-11-0x0000000004EE0000-0x0000000004F20000-memory.dmp

    Filesize

    256KB

  • memory/2452-12-0x0000000073A5E000-0x0000000073A5F000-memory.dmp

    Filesize

    4KB

  • memory/2452-16-0x0000000002DC0000-0x0000000002DD6000-memory.dmp

    Filesize

    88KB

  • memory/2452-17-0x0000000074210000-0x0000000074226000-memory.dmp

    Filesize

    88KB

  • memory/2452-153-0x0000000002A00000-0x0000000002A44000-memory.dmp

    Filesize

    272KB

  • memory/2452-154-0x0000000004EE0000-0x0000000004F20000-memory.dmp

    Filesize

    256KB

  • memory/2452-155-0x0000000073A5E000-0x0000000073A5F000-memory.dmp

    Filesize

    4KB