Analysis
-
max time kernel
91s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
24-01-2023 17:45
Static task
static1
Behavioral task
behavioral1
Sample
LDPlayer9.0_es_1260_ld.exe
Resource
win7-20221111-en
windows7-x64
29 signatures
150 seconds
Behavioral task
behavioral2
Sample
LDPlayer9.0_es_1260_ld.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
LDPlayer9.0_es_1260_ld.exe
-
Size
601.8MB
-
MD5
83a052a5a9de3c30cb8aaaa81685bea7
-
SHA1
07daf5f6f24c624228bf7da6e2e1c93241fe030e
-
SHA256
d773c7ca94b97abc9660727ceefcdb8d98f122fe6dd08aca911fd85fe153d25f
-
SHA512
65dc36e77e50b27a9fbfd23623696c8d60ec4b08aef61d19801ff390e676fc40cef4f45c8dd1a744c746e02c4d88052db674d48d8ef8449a263e08f10a1e1545
-
SSDEEP
12582912:K0NMKTyRY5yMou7KBC8CckWqYkqiQh90CLmjT:joRYgu7KB9DpkchCg6T
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation LDPlayer9.0_es_1260_ld.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 392 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe 4800 LDPlayer9.0_es_1260_ld.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeTakeOwnershipPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe Token: SeDebugPrivilege 4800 LDPlayer9.0_es_1260_ld.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4800 wrote to memory of 392 4800 LDPlayer9.0_es_1260_ld.exe 81 PID 4800 wrote to memory of 392 4800 LDPlayer9.0_es_1260_ld.exe 81 PID 4800 wrote to memory of 392 4800 LDPlayer9.0_es_1260_ld.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer9.0_es_1260_ld.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer9.0_es_1260_ld.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM dnmultiplayerex.exe /T2⤵
- Kills process with taskkill
PID:392
-