a2d0d1739b392a98fc66ad4fa82ab3102ddf117bf0b5771ca3a5f8d3295e2184

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23-07-2023 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LDPlayer9_es_1009_ld.exe
Size

2.5MB
MD5

83c2a7913043419ef1e31973e69d00d1
SHA1

55c1d6abbe4c7e2b5921a9d4ab82d3b7a4ee23e3
SHA256

a2d0d1739b392a98fc66ad4fa82ab3102ddf117bf0b5771ca3a5f8d3295e2184
SHA512

cc433e4ebeabef236a4ca8ecf0c6c7c3474949a7d16b8a68de8c8e2674542e3155ed095b4dda96e2dcd22725725ea9edf8226599869225152955ef8854a3f29a
SSDEEP

24576:r43bxJag6IHA7pYkWzRpi3UZGIlXHg1qQrlRUK80U3612926/kvppVUm4ReeIPEY:g/6Ig7pwjTElRQ0UK1ukx0RbKEL8F

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2836 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2836 taskkill.exe

pid	process
2836	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2836	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

LDPlayer9_es_1009_ld.exe

description	pid	process	target process
PID 2632 wrote to memory of 2836	2632	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 2632 wrote to memory of 2836	2632	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 2632 wrote to memory of 2836	2632	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 2632 wrote to memory of 2836	2632	LDPlayer9_es_1009_ld.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\taskkill.exe
"taskkill" /F /IM ldcurl.exe /T
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads