plugx | 93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e

General

Target

93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe
Size

204KB
MD5

27f49c4608311a736ef96673b2300531
SHA1

da24c13d479932796e992c1f42e979e637e476d0
SHA256

93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e
SHA512

8a698f8ac861e5545141e36faf35e91123cdb9ddaa2f7d8923ca4d80cf276325ccba900321b3b503473d2769c93a92ec6fa9bd2c2b3f2b3552202fdf25f7d30c

Score

10^/10

plugx persistence trojan

Malware Config

Extracted

Family

plugx

C2

rainydaysweb.com:80

rainydaysweb.com:443

rainydaysweb.com:53

Mutex

dhHRYvLNaOVJXZdDsbdc

Attributes

folder
AAM UpdatesblF

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Executes dropped EXE 2 IoCs

pid	Process
1988	web.exe
1612	AAM Updates.exe

Loads dropped DLL 4 IoCs

pid	Process
1432	rundll32.exe
1988	web.exe
1988	web.exe
1612	AAM Updates.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	web.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AAM UpdatesblF = "\"C:\\ProgramData\\AAM UpdatesblF\\AAM Updates.exe\" 429"	web.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run	web.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\AAM UpdatesblF = "\"C:\\ProgramData\\AAM UpdatesblF\\AAM Updates.exe\" 429"	web.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu\PROXY	AAM Updates.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu	AAM Updates.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\PROXY	AAM Updates.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1612	AAM Updates.exe
1612	AAM Updates.exe
1612	AAM Updates.exe
1612	AAM Updates.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	AAM Updates.exe
Token: SeDebugPrivilege	1612	AAM Updates.exe
Token: SeTcbPrivilege	1612	AAM Updates.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1432	1864	93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe	26
PID 1864 wrote to memory of 1432	1864	93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe	26
PID 1864 wrote to memory of 1432	1864	93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe	26
PID 1864 wrote to memory of 1432	1864	93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe	26
PID 1864 wrote to memory of 1432	1864	93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe	26
PID 1864 wrote to memory of 1432	1864	93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe	26
PID 1864 wrote to memory of 1432	1864	93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe	26
PID 1432 wrote to memory of 1988	1432	rundll32.exe	27
PID 1432 wrote to memory of 1988	1432	rundll32.exe	27
PID 1432 wrote to memory of 1988	1432	rundll32.exe	27
PID 1432 wrote to memory of 1988	1432	rundll32.exe	27
PID 1988 wrote to memory of 1612	1988	web.exe	29
PID 1988 wrote to memory of 1612	1988	web.exe	29
PID 1988 wrote to memory of 1612	1988	web.exe	29
PID 1988 wrote to memory of 1612	1988	web.exe	29
PID 1988 wrote to memory of 1612	1988	web.exe	29
PID 1988 wrote to memory of 1612	1988	web.exe	29
PID 1988 wrote to memory of 1612	1988	web.exe	29

C:\Users\Admin\AppData\Local\Temp\93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe
"C:\Users\Admin\AppData\Local\Temp\93d33626886e97abf4087f5445b2a02738ea21d8624b3f015625cd646e9d986e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" url.dll, FileProtocolHandler C:\Users\Admin\AppData\Local\Temp\web.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Users\Admin\AppData\Local\Temp\web.exe
    "C:\Users\Admin\AppData\Local\Temp\web.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\ProgramData\AAM UpdatesblF\AAM Updates.exe
      "C:\ProgramData\AAM UpdatesblF\AAM Updates.exe" 429
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1612-77-0x0000000001FF0000-0x0000000005C21000-memory.dmp

Filesize
60.2MB

Download
memory/1864-59-0x0000000076A81000-0x0000000076A83000-memory.dmp

Filesize
8KB

Download
memory/1988-69-0x00000000020D0000-0x0000000005D01000-memory.dmp

Filesize
60.2MB

Download

Analysis

Sharing