Analysis

  • max time kernel
    144s
  • max time network
    124s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-06-2021 11:20

General

  • Target

    Folder.exe

  • Size

    876KB

  • MD5

    710ed49d2ea4c31614ec7167fc2dd67c

  • SHA1

    f5b961ce09e158c3c1d9531767ace98f3d173550

  • SHA256

    956afc0c6d10b544f71fee126a4fd36f91fb64c2ed86b73ea1b44dc57a7e2082

  • SHA512

    188480ca9dd4fab70f5b0142d03c0409365644794e3097a543bf4d29a122b7f3cc2ea2b59430e8aff5f36b264d027e3c0e71d07e89e7bc296cdaba2dde0e1e55

Score
10/10

Malware Config

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
      PID:2696
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
      • Modifies registry class
      PID:2688
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2580
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2408
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2380
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1864
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1388
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1272
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1228
                  • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                    "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                    1⤵
                    • Checks computer location settings
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:3988
                    • C:\Windows\SysWOW64\rUNdlL32.eXe
                      "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                      2⤵
                      • Loads dropped DLL
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2496
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1108
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:1020
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:348
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3128
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3996

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/348-194-0x00000227A6520000-0x00000227A6591000-memory.dmp

                          Filesize

                          452KB

                        • memory/348-134-0x00000227A64A0000-0x00000227A6511000-memory.dmp

                          Filesize

                          452KB

                        • memory/1020-215-0x000002B851640000-0x000002B8516B1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1020-164-0x000002B851100000-0x000002B851171000-memory.dmp

                          Filesize

                          452KB

                        • memory/1108-213-0x000001DAA6070000-0x000001DAA60E1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1108-162-0x000001DAA5910000-0x000001DAA5981000-memory.dmp

                          Filesize

                          452KB

                        • memory/1228-170-0x00000201DA510000-0x00000201DA581000-memory.dmp

                          Filesize

                          452KB

                        • memory/1228-199-0x00000201DA620000-0x00000201DA691000-memory.dmp

                          Filesize

                          452KB

                        • memory/1272-204-0x0000018A9E4F0000-0x0000018A9E561000-memory.dmp

                          Filesize

                          452KB

                        • memory/1272-172-0x0000018A9E0C0000-0x0000018A9E131000-memory.dmp

                          Filesize

                          452KB

                        • memory/1388-166-0x000001F84EB20000-0x000001F84EB91000-memory.dmp

                          Filesize

                          452KB

                        • memory/1388-190-0x000001F84F1B0000-0x000001F84F221000-memory.dmp

                          Filesize

                          452KB

                        • memory/1864-168-0x0000029DB56B0000-0x0000029DB5721000-memory.dmp

                          Filesize

                          452KB

                        • memory/1864-195-0x0000029DB57A0000-0x0000029DB5811000-memory.dmp

                          Filesize

                          452KB

                        • memory/2380-160-0x0000018472F60000-0x0000018472FD1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2380-207-0x00000184735B0000-0x0000018473621000-memory.dmp

                          Filesize

                          452KB

                        • memory/2408-200-0x0000017F63160000-0x0000017F631D1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2408-140-0x0000017F63070000-0x0000017F630E1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2496-122-0x0000000004EC1000-0x0000000004FC2000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/2496-127-0x0000000004D50000-0x0000000004DAC000-memory.dmp

                          Filesize

                          368KB

                        • memory/2580-189-0x000001B7141C0000-0x000001B714231000-memory.dmp

                          Filesize

                          452KB

                        • memory/2580-128-0x000001B713E00000-0x000001B713E71000-memory.dmp

                          Filesize

                          452KB

                        • memory/2688-210-0x0000018AA51D0000-0x0000018AA51D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2688-212-0x0000018AA5DC0000-0x0000018AA5E31000-memory.dmp

                          Filesize

                          452KB

                        • memory/2688-176-0x0000018AA5A00000-0x0000018AA5A71000-memory.dmp

                          Filesize

                          452KB

                        • memory/2688-159-0x0000018AA51D0000-0x0000018AA51D2000-memory.dmp

                          Filesize

                          8KB

                        • memory/2696-174-0x000001371A060000-0x000001371A0D1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2696-208-0x000001371A160000-0x000001371A1D1000-memory.dmp

                          Filesize

                          452KB

                        • memory/3128-135-0x0000024647260000-0x00000246472D1000-memory.dmp

                          Filesize

                          452KB

                        • memory/3996-125-0x0000018A9F080000-0x0000018A9F0CB000-memory.dmp

                          Filesize

                          300KB

                        • memory/3996-129-0x0000018A9F210000-0x0000018A9F281000-memory.dmp

                          Filesize

                          452KB

                        • memory/3996-180-0x0000018AA0BA0000-0x0000018AA0BBB000-memory.dmp

                          Filesize

                          108KB

                        • memory/3996-178-0x0000018AA1A00000-0x0000018AA1B06000-memory.dmp

                          Filesize

                          1.0MB