07bd1745baa33c6abb773c13fb4c65aa35b18b21d7e514af3bf5fd20cd97e500

General

Target

LDPlayer9_ens_25143662_ld.exe
Size

2.9MB
MD5

79170cdc94a59fd6e174bd56d8ccadcb
SHA1

c3e8aa07bfb7625194def68231b4db42ca3d6610
SHA256

07bd1745baa33c6abb773c13fb4c65aa35b18b21d7e514af3bf5fd20cd97e500
SHA512

7eb94acbf573a7528709197c96d7edaebce05d1f9aebb5a5992b4fb8c6b88e4cd4c9a4edd1f030362832860da992282476a13dcdb1cb8ca51065df7804a8afc3
SSDEEP

49152:mi/fEwEHpp4/PrRw1SYFjAbDiY+UjwxxtG8N9Hm:mi/8wEHpW/Pa1BF8+QwxKj

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

LDPlayer.exe

pid process

1384 LDPlayer.exe
Loads dropped DLL 1 IoCs

Processes:

LDPlayer9_ens_25143662_ld.exe

pid process

1108 LDPlayer9_ens_25143662_ld.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 7 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

1240 taskkill.exe
1256 taskkill.exe
1808 taskkill.exe
1932 taskkill.exe
1748 taskkill.exe
1564 taskkill.exe
1656 taskkill.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

LDPlayer.exe

pid process

1384 LDPlayer.exe
1384 LDPlayer.exe
1384 LDPlayer.exe
1384 LDPlayer.exe
1384 LDPlayer.exe
1384 LDPlayer.exe

pid	process
1384	LDPlayer.exe

pid	process
1108	LDPlayer9_ens_25143662_ld.exe

pid	process
1240	taskkill.exe
1256	taskkill.exe
1808	taskkill.exe
1932	taskkill.exe
1748	taskkill.exe
1564	taskkill.exe
1656	taskkill.exe

pid	process
1384	LDPlayer.exe
1384	LDPlayer.exe
1384	LDPlayer.exe
1384	LDPlayer.exe
1384	LDPlayer.exe
1384	LDPlayer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exeLDPlayer.exe

description	pid	process
Token: SeDebugPrivilege	1564	taskkill.exe
Token: SeDebugPrivilege	1656	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	1256	taskkill.exe
Token: SeTakeOwnershipPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeTakeOwnershipPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe
Token: SeDebugPrivilege	1384	LDPlayer.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

LDPlayer9_ens_25143662_ld.exeLDPlayer.exe

description	pid	process	target process
PID 1108 wrote to memory of 1564	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1564	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1564	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1564	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1656	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1656	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1656	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1656	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1240	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1240	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1240	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1240	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1256	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1256	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1256	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1256	1108	LDPlayer9_ens_25143662_ld.exe	taskkill.exe
PID 1108 wrote to memory of 1384	1108	LDPlayer9_ens_25143662_ld.exe	LDPlayer.exe
PID 1108 wrote to memory of 1384	1108	LDPlayer9_ens_25143662_ld.exe	LDPlayer.exe
PID 1108 wrote to memory of 1384	1108	LDPlayer9_ens_25143662_ld.exe	LDPlayer.exe
PID 1108 wrote to memory of 1384	1108	LDPlayer9_ens_25143662_ld.exe	LDPlayer.exe
PID 1384 wrote to memory of 1808	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1808	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1808	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1808	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1932	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1932	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1932	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1932	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1748	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1748	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1748	1384	LDPlayer.exe	taskkill.exe
PID 1384 wrote to memory of 1748	1384	LDPlayer.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_25143662_ld.exe
"C:\Users\Admin\AppData\Local\Temp\LDPlayer9_ens_25143662_ld.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM dnplayer.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM dnmultiplayer.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM dnupdate.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill" /F /IM bugreport.exe /T
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1256
- C:\LDPlayer\LDPlayer9\LDPlayer.exe
  "C:\LDPlayer\LDPlayer9\\LDPlayer.exe" -silence -downloader -openid=25143662 -language=en -path="C:\LDPlayer\LDPlayer9\"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\System32\taskkill.exe" /F /IM dnmultiplayerex.exe /T
    3⤵
    - Kills process with taskkill
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM fynews.exe
    3⤵
    - Kills process with taskkill
    PID:1932
- - C:\Windows\SysWOW64\taskkill.exe
    "taskkill" /F /IM ldnews.exe
    3⤵
    - Kills process with taskkill
    PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\LDPlayer\LDPlayer9\LDPlayer.exe

Filesize
624.4MB

MD5
63697f0dd4517a0c2097024c8c77042c

SHA1
4b36054047f1d0db4a1b76cfef64ae58d0df4e3b

SHA256
66f1173169ac00e7e850d086dae40f68d9439799926e08950cd74c8be61ca030

SHA512
aa976d1ace77f66db4a9e6180b4e93294d19cc259e2f8d7da2c5f00975d5b8af3265a8c61cdf572c935a2ee279fee2f7a8029dbcf51018c4da7c4959c24f9851

Download Submit
\LDPlayer\LDPlayer9\LDPlayer.exe

Filesize
624.4MB

MD5
63697f0dd4517a0c2097024c8c77042c

SHA1
4b36054047f1d0db4a1b76cfef64ae58d0df4e3b

SHA256
66f1173169ac00e7e850d086dae40f68d9439799926e08950cd74c8be61ca030

SHA512
aa976d1ace77f66db4a9e6180b4e93294d19cc259e2f8d7da2c5f00975d5b8af3265a8c61cdf572c935a2ee279fee2f7a8029dbcf51018c4da7c4959c24f9851

Download Submit

Analysis

Sharing