Analysis
-
max time kernel
91s -
max time network
166s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2024 21:55
Static task
static1
Behavioral task
behavioral1
Sample
LDPlayer Lite.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
LDPlayer Lite.exe
Resource
win10v2004-20241007-en
General
-
Target
LDPlayer Lite.exe
-
Size
334.4MB
-
MD5
26658b7ef34d2210c7ea60da509e656c
-
SHA1
3c1af2b1ab449880251f00d2451c38fe23895fa4
-
SHA256
622a74a1652ce848af35a2024eac1f3fd4269b6a381361bc06f7080fc7ad4180
-
SHA512
823d45c05e0dee8a04956eba2c4a7d0e48aa43c130b6653a7bde6cd44ef581e1600463538e897af17e5bd3d030b45ab135e4aa27637f1d1652ccb7b894ca67bc
-
SSDEEP
6291456:TZ1ZafwX7v0tj6FMcBgbw0zE4kyJ4RDydneb7bxjEsTtzqXQz4aue6VYdFJyGqX0:TZz0tSBgc0zXJ4tIevtjEsTtzqXQ8lV6
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
LDPlayer Lite.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation LDPlayer Lite.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
LDPlayer Lite.exetaskkill.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LDPlayer Lite.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 384 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
LDPlayer Lite.exepid process 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe 4084 LDPlayer Lite.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
LDPlayer Lite.exedescription pid process Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeTakeOwnershipPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe Token: SeDebugPrivilege 4084 LDPlayer Lite.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
LDPlayer Lite.exedescription pid process target process PID 4084 wrote to memory of 384 4084 LDPlayer Lite.exe taskkill.exe PID 4084 wrote to memory of 384 4084 LDPlayer Lite.exe taskkill.exe PID 4084 wrote to memory of 384 4084 LDPlayer Lite.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LDPlayer Lite.exe"C:\Users\Admin\AppData\Local\Temp\LDPlayer Lite.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /F /IM dnmultiplayerex.exe /T2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:384