9bb59ea13d91b11739e9eb8e39ab243d80935310838b0f60b450ac2a906aabee

Analysis

max time kernel
29s
max time network
61s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
23-11-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LDPlayer9_ens_88467245_ld.exe
Size

2.5MB
MD5

4b3458b9c6aaa39ef37fc290459b6908
SHA1

ba8b683eca181784d049efd008f50aacf5cf4079
SHA256

9bb59ea13d91b11739e9eb8e39ab243d80935310838b0f60b450ac2a906aabee
SHA512

0f3977bb0b137ad65465a38be1d97acbd50e1f57078c7bed957fd0c210d1bd5f4895b9afac8af4c202a3f905f021cc7042210fe030ff5de6e6cb7c4f90591dec
SSDEEP

49152:1gwNggyPXuB7fEtKubsISTb/am5B8y6sEUhSSwhUPMum:1gwNggyPX48zbsIW/amj8yF8Sg

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

LDPlayer9_ens_88467245_ld.exe

description ioc process

File opened (read-only) \??\F: LDPlayer9_ens_88467245_ld.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

LDPlayer9_ens_88467245_ld.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDPlayer9_ens_88467245_ld.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

LDPlayer9_ens_88467245_ld.exe

pid process

2960 LDPlayer9_ens_88467245_ld.exe
2960 LDPlayer9_ens_88467245_ld.exe

description	ioc	process
File opened (read-only)	\??\F:	LDPlayer9_ens_88467245_ld.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LDPlayer9_ens_88467245_ld.exe

pid	process
2960	LDPlayer9_ens_88467245_ld.exe
2960	LDPlayer9_ens_88467245_ld.exe

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_88467245_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_88467245_ld.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads