a2d0d1739b392a98fc66ad4fa82ab3102ddf117bf0b5771ca3a5f8d3295e2184

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2023 03:19

Target

LDPlayer9_es_1009_ld.exe
Size

2.5MB
MD5

83c2a7913043419ef1e31973e69d00d1
SHA1

55c1d6abbe4c7e2b5921a9d4ab82d3b7a4ee23e3
SHA256

a2d0d1739b392a98fc66ad4fa82ab3102ddf117bf0b5771ca3a5f8d3295e2184
SHA512

cc433e4ebeabef236a4ca8ecf0c6c7c3474949a7d16b8a68de8c8e2674542e3155ed095b4dda96e2dcd22725725ea9edf8226599869225152955ef8854a3f29a
SSDEEP

24576:r43bxJag6IHA7pYkWzRpi3UZGIlXHg1qQrlRUK80U3612926/kvppVUm4ReeIPEY:g/6Ig7pwjTElRQ0UK1ukx0RbKEL8F

Score

8^/10

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

LDPlayer.exe

pid process

2608 LDPlayer.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

3760 taskkill.exe
1108 taskkill.exe
4572 taskkill.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exe

description pid process

Token: SeDebugPrivilege 3760 taskkill.exe
Token: SeDebugPrivilege 1108 taskkill.exe
Token: SeDebugPrivilege 4572 taskkill.exe

pid	process
2608	LDPlayer.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

LDPlayer9_es_1009_ld.exe

description	pid	process	target process
PID 1068 wrote to memory of 3760	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 3760	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 3760	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 1108	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 1108	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 1108	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 4572	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 4572	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 4572	1068	LDPlayer9_es_1009_ld.exe	taskkill.exe
PID 1068 wrote to memory of 2608	1068	LDPlayer9_es_1009_ld.exe	LDPlayer.exe
PID 1068 wrote to memory of 2608	1068	LDPlayer9_es_1009_ld.exe	LDPlayer.exe
PID 1068 wrote to memory of 2608	1068	LDPlayer9_es_1009_ld.exe	LDPlayer.exe

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_es_1009_ld.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1068

F:\LDPlayer\LDPlayer9\LDPlayer.exe
"F:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=1009 -language=es -path="F:\LDPlayer\LDPlayer9\"
2⤵
- Executes dropped EXE
PID:2608

F:\LDPlayer\LDPlayer9\LDPlayer.exe
Filesize
449.8MB

MD5
430264bf4809cecea7c3cf107ef48098

SHA1
59ab61bb86037eeaf119cd363cd2cddd22b4a540

SHA256
00489a758aa63fe06ec6af1844de9f68403305326972794ca10ef6a9926f2f1c

SHA512
0a9784b84bc9f064f807a7a685ee2690c92ca802136bd5c18daea41506f912969c4a72c11ef9258ad0f912b5a238eb915af2242a47b55e96a5715d542a376ebe

Download Submit
F:\LDPlayer\LDPlayer9\LDPlayer.exe
Filesize
450.7MB

MD5
871e398279de0ce29f454b06cff20bec

SHA1
2a367cfdfdc2cea44b6c1dbf636ff151f1b24d50

SHA256
cf1752f4a3ffd2d77a31f542dd0eb0a208c58aaa760445718044a511ab56b52b

SHA512
861ce9192bb16b8f269a5dfa6a971eafa465b4a3816614ec49cd8b1bb49543b28af500903a1f622c7d152feecdf42579160403b7e21d00e5c604a416fa90be24

Download Submit