plugx | f631e8f0c723cccbc5b26387f4100351de2e158b6770e962733734be6ca119d5

Analysis

Target
plugx_decrypted_dll.bin.dll
Size 160KB
Sample200827-ltl1v96efj
SHA256 f631e8f0c723cccbc5b26387f4100351de2e158b6770e962733734be6ca119d5
MD5 4a741672a02b882d66d7846089aae197
SHA1 264560796c02cbb28a56536d15122f962f6df5b4
SHA512 26db240bb2ccf3f4cd71116ba4514d8ca373464d73a9b2629cb0524311bbf3985b9985b577b2fe3f1915ab1a24d64e137d6b72e2e2af52ea5b7d43ec5f09df52
MD5 SHA1 SHA512

Score

10^/10

plugx trojan

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	3028	WerFault.exe	66

Suspicious behavior: EnumeratesProcesses 13 IoCs

Suspicious use of AdjustPrivilegeToken 3 IoCs

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 3028	3908	rundll32.exe	66
PID 3908 wrote to memory of 3028	3908	rundll32.exe	66
PID 3908 wrote to memory of 3028	3908	rundll32.exe	66

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugx_decrypted_dll.bin.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\plugx_decrypted_dll.bin.dll,#1
  2⤵
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 616
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024

memory/3024-1-0x00000000044A0000-0x00000000044A1000-memory.dmp

Download