plugx | d531c8a488aea1f8bb428526fc913801441b01c0742213e7d7fbed3b9163d354

Analysis

max time kernel
128s
max time network
139s
platform
windows10_x64
resource
win10v20201028
submitted
04-03-2021 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AAM UpdatesHtA.bin.exe
Size

485KB
MD5

eb941fbca579d3c0966de86b904fc298
SHA1

d2aa567fa30befa6e082376b11587aa0f3b0d5b7
SHA256

d64afd9799d8de3f39a4ce99584fa67a615a667945532cfa3f702adbe27724c4
SHA512

168e5fbbd86950cf409ac2f50d5b0b81c295d8c291077d974d1adad11313c3a4ccb9e5d623a5769136cce3eba33b35acb4f39f6fd1c9323ea0ceb46eb85991f5

Score

10^/10

plugx persistence trojan

Malware Config

Extracted

Family

plugx

45.251.240.55:443

45.251.240.55:8080

45.251.240.55:8000

Mutex

EDysZYTmoiuUydWatmWb

Attributes

folder
AAM UpdatesHtA

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 2 IoCs

Processes:

AAM Updates.exeAAM Updates.exe

pid process

2932 AAM Updates.exe
3964 AAM Updates.exe
Loads dropped DLL 2 IoCs

Processes:

AAM Updates.exeAAM Updates.exe

pid process

2932 AAM Updates.exe
3964 AAM Updates.exe

pid	process
2932	AAM Updates.exe
3964	AAM Updates.exe

pid	process
2932	AAM Updates.exe
3964	AAM Updates.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AAM Updates.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	AAM Updates.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AAM UpdatesHtA = "\"C:\\ProgramData\\AAM UpdatesHtA\\AAM Updates.exe\" 933"	AAM Updates.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	AAM Updates.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\AAM UpdatesHtA = "\"C:\\ProgramData\\AAM UpdatesHtA\\AAM Updates.exe\" 933"	AAM Updates.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

AAM Updates.exe

description ioc process

File opened (read-only) \??\D: AAM Updates.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened (read-only)	\??\D:	AAM Updates.exe

Modifies registry class 5 IoCs

Processes:

AAM Updates.exeAAM Updates.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	AAM Updates.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu\PROXY	AAM Updates.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	AAM Updates.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\ms-pu	AAM Updates.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\CLSID = 42003200360037004200340045003700350039003700430033004300370042000000	AAM Updates.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

AAM Updates.exe

pid process

3964 AAM Updates.exe
3964 AAM Updates.exe
3964 AAM Updates.exe
3964 AAM Updates.exe
3964 AAM Updates.exe
3964 AAM Updates.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

AAM Updates.exe

description pid process

Token: SeDebugPrivilege 3964 AAM Updates.exe
Token: SeDebugPrivilege 3964 AAM Updates.exe
Token: SeTcbPrivilege 3964 AAM Updates.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AAM UpdatesHtA.bin.exe

pid process

508 AAM UpdatesHtA.bin.exe
508 AAM UpdatesHtA.bin.exe

pid	process
3964	AAM Updates.exe
3964	AAM Updates.exe
3964	AAM Updates.exe
3964	AAM Updates.exe
3964	AAM Updates.exe
3964	AAM Updates.exe

description	pid	process
Token: SeDebugPrivilege	3964	AAM Updates.exe
Token: SeDebugPrivilege	3964	AAM Updates.exe
Token: SeTcbPrivilege	3964	AAM Updates.exe

pid	process
508	AAM UpdatesHtA.bin.exe
508	AAM UpdatesHtA.bin.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

AAM UpdatesHtA.bin.exeAAM Updates.exe

description	pid	process	target process
PID 508 wrote to memory of 2932	508	AAM UpdatesHtA.bin.exe	AAM Updates.exe
PID 508 wrote to memory of 2932	508	AAM UpdatesHtA.bin.exe	AAM Updates.exe
PID 508 wrote to memory of 2932	508	AAM UpdatesHtA.bin.exe	AAM Updates.exe
PID 2932 wrote to memory of 3964	2932	AAM Updates.exe	AAM Updates.exe
PID 2932 wrote to memory of 3964	2932	AAM Updates.exe	AAM Updates.exe
PID 2932 wrote to memory of 3964	2932	AAM Updates.exe	AAM Updates.exe

C:\Users\Admin\AppData\Local\Temp\AAM UpdatesHtA.bin.exe
"C:\Users\Admin\AppData\Local\Temp\AAM UpdatesHtA.bin.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:508

C:\Users\Admin\AppData\Local\Temp\AAM Updates.exe
"C:\Users\Admin\AppData\Local\Temp\AAM Updates.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2932

C:\ProgramData\AAM UpdatesHtA\AAM Updates.exe
"C:\ProgramData\AAM UpdatesHtA\AAM Updates.exe" 933
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AAM UpdatesHtA\AAM Updates.exe
MD5
c70d8dce46b4551133ecc58aed84bf0e

SHA1
00626346632fdfb2a1d5831793e92a3601ec4d9f

SHA256
0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681

SHA512
12117c7fa9acef9a2a8d7da53a2a435dd45298bb98439025e2c4a3bb0c8096675d5541c0b2eb7246164e2a19cd879f98c0a007b0f73691d59036822be01a6f92

Download Submit
C:\ProgramData\AAM UpdatesHtA\AAM Updates.exe
MD5
c70d8dce46b4551133ecc58aed84bf0e

SHA1
00626346632fdfb2a1d5831793e92a3601ec4d9f

SHA256
0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681

SHA512
12117c7fa9acef9a2a8d7da53a2a435dd45298bb98439025e2c4a3bb0c8096675d5541c0b2eb7246164e2a19cd879f98c0a007b0f73691d59036822be01a6f92

Download Submit
C:\ProgramData\AAM UpdatesHtA\HEX.dll
MD5
b061d981d224454ffd8d692cf7ee92b7

SHA1
2c93c30207786343f3de6ca540d14fefc237a9b4

SHA256
14f9278f3515fae71ccb8073cfaf73bdcc00eab3888d8cee6fb43a4f51c9e699

SHA512
ac1923f62becd49f164f9ff6782468e554a6a13b5d00cff3fb889f8198d311004ecfe9658ccad58b348e2b39d4e8c51d9623e658d64a2fdcafa82e4b86493014

Download Submit
C:\ProgramData\AAM UpdatesHtA\adobeupdate.dat
MD5
317705ca7476ac9a754b80fded717f6b

SHA1
ed690e1eb83b4a71529e2b8e92d9699f53171250

SHA256
abd6521990e88bd18bbcba063744efe0ccac23063bb340720cc3f610d9b1c770

SHA512
2d452ab0fa2f2692061b1afb43bea1ead1bc47b328a00e8508e1121446646cb6ce686bf4d9538cdaf2c176ba0ae59df701930331cc52a3d94cc1ba9d64abf167

Download Submit
C:\Users\Admin\AppData\Local\Temp\AAM Updates.exe
MD5
c70d8dce46b4551133ecc58aed84bf0e

SHA1
00626346632fdfb2a1d5831793e92a3601ec4d9f

SHA256
0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681

SHA512
12117c7fa9acef9a2a8d7da53a2a435dd45298bb98439025e2c4a3bb0c8096675d5541c0b2eb7246164e2a19cd879f98c0a007b0f73691d59036822be01a6f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\AAM Updates.exe
MD5
c70d8dce46b4551133ecc58aed84bf0e

SHA1
00626346632fdfb2a1d5831793e92a3601ec4d9f

SHA256
0459e62c5444896d5be404c559c834ba455fa5cae1689c70fc8c61bc15468681

SHA512
12117c7fa9acef9a2a8d7da53a2a435dd45298bb98439025e2c4a3bb0c8096675d5541c0b2eb7246164e2a19cd879f98c0a007b0f73691d59036822be01a6f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\HEX.dll
MD5
b061d981d224454ffd8d692cf7ee92b7

SHA1
2c93c30207786343f3de6ca540d14fefc237a9b4

SHA256
14f9278f3515fae71ccb8073cfaf73bdcc00eab3888d8cee6fb43a4f51c9e699

SHA512
ac1923f62becd49f164f9ff6782468e554a6a13b5d00cff3fb889f8198d311004ecfe9658ccad58b348e2b39d4e8c51d9623e658d64a2fdcafa82e4b86493014

Download Submit
C:\Users\Admin\AppData\Local\Temp\adobeupdate.dat
MD5
317705ca7476ac9a754b80fded717f6b

SHA1
ed690e1eb83b4a71529e2b8e92d9699f53171250

SHA256
abd6521990e88bd18bbcba063744efe0ccac23063bb340720cc3f610d9b1c770

SHA512
2d452ab0fa2f2692061b1afb43bea1ead1bc47b328a00e8508e1121446646cb6ce686bf4d9538cdaf2c176ba0ae59df701930331cc52a3d94cc1ba9d64abf167

Download Submit
\ProgramData\AAM UpdatesHtA\hex.dll
MD5
b061d981d224454ffd8d692cf7ee92b7

SHA1
2c93c30207786343f3de6ca540d14fefc237a9b4

SHA256
14f9278f3515fae71ccb8073cfaf73bdcc00eab3888d8cee6fb43a4f51c9e699

SHA512
ac1923f62becd49f164f9ff6782468e554a6a13b5d00cff3fb889f8198d311004ecfe9658ccad58b348e2b39d4e8c51d9623e658d64a2fdcafa82e4b86493014

Download Submit
\Users\Admin\AppData\Local\Temp\hex.dll
MD5
b061d981d224454ffd8d692cf7ee92b7

SHA1
2c93c30207786343f3de6ca540d14fefc237a9b4

SHA256
14f9278f3515fae71ccb8073cfaf73bdcc00eab3888d8cee6fb43a4f51c9e699

SHA512
ac1923f62becd49f164f9ff6782468e554a6a13b5d00cff3fb889f8198d311004ecfe9658ccad58b348e2b39d4e8c51d9623e658d64a2fdcafa82e4b86493014

Download Submit
memory/2932-9-0x00000000023D0000-0x0000000006006000-memory.dmp

Filesize
60.2MB

Download
memory/2932-3-0x0000000000000000-mapping.dmp

Download
memory/3964-10-0x0000000000000000-mapping.dmp

Download
memory/3964-16-0x0000000002AD0000-0x0000000006706000-memory.dmp

Filesize
60.2MB

Download