Analysis

  • max time kernel
    145s
  • max time network
    123s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    15-06-2021 10:44

General

  • Target

    05ed376b3de1d54ac4af50d10b1f08c1.exe

  • Size

    875KB

  • MD5

    05ed376b3de1d54ac4af50d10b1f08c1

  • SHA1

    def26ad3020710b39b79b97f4684d9e057c97b1c

  • SHA256

    6e992161f236fbafbb836065a819195d69af9ba7544ab71542111ac2b3ea8664

  • SHA512

    77afad95dd792ee83230bc8a9ec59285de882d9b19d3608da126e715505d4895b1c79ce10e1a553f175bc18e4dbad001b6e015d559cd601a1f50b450fd8aa19b

Score
10/10

Malware Config

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
    1⤵
      PID:944
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
      1⤵
        PID:1872
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2404
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2444
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
              PID:2792
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
              1⤵
                PID:2584
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                1⤵
                  PID:2588
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                  • Modifies registry class
                  PID:1416
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1356
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Themes
                    1⤵
                      PID:1208
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1104
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:1004
                        • C:\Users\Admin\AppData\Local\Temp\05ed376b3de1d54ac4af50d10b1f08c1.exe
                          "C:\Users\Admin\AppData\Local\Temp\05ed376b3de1d54ac4af50d10b1f08c1.exe"
                          1⤵
                          • Checks computer location settings
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:4440
                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",init
                            2⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4984
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4588
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3132

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/944-164-0x000001F190F50000-0x000001F190FC1000-memory.dmp

                          Filesize

                          452KB

                        • memory/944-211-0x000001F191170000-0x000001F1911E1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1004-196-0x000001D452740000-0x000001D4527B1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1004-156-0x000001D452170000-0x000001D4521E1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1104-209-0x00000196D2740000-0x00000196D27B1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1104-162-0x00000196D2110000-0x00000196D2181000-memory.dmp

                          Filesize

                          452KB

                        • memory/1208-192-0x000001BC5DA50000-0x000001BC5DAC1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1208-170-0x000001BC5D960000-0x000001BC5D9D1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1356-197-0x000001BB30240000-0x000001BB302B1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1356-172-0x000001BB2FD40000-0x000001BB2FDB1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1416-166-0x000001DC936A0000-0x000001DC93711000-memory.dmp

                          Filesize

                          452KB

                        • memory/1416-213-0x000001DC93800000-0x000001DC93871000-memory.dmp

                          Filesize

                          452KB

                        • memory/1872-168-0x000002202BF80000-0x000002202BFF1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1872-188-0x000002202C000000-0x000002202C002000-memory.dmp

                          Filesize

                          8KB

                        • memory/1872-215-0x000002202C540000-0x000002202C5B1000-memory.dmp

                          Filesize

                          452KB

                        • memory/1872-141-0x000002202C000000-0x000002202C002000-memory.dmp

                          Filesize

                          8KB

                        • memory/2404-207-0x0000020584FC0000-0x0000020585031000-memory.dmp

                          Filesize

                          452KB

                        • memory/2404-160-0x0000020584F40000-0x0000020584FB1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2444-158-0x00000227F1B10000-0x00000227F1B81000-memory.dmp

                          Filesize

                          452KB

                        • memory/2444-204-0x00000227F1C20000-0x00000227F1C91000-memory.dmp

                          Filesize

                          452KB

                        • memory/2584-174-0x0000022816B60000-0x0000022816BD1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2584-201-0x0000022817340000-0x00000228173B1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2588-205-0x0000016B79B80000-0x0000016B79BF1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2588-176-0x0000016B79AD0000-0x0000016B79B41000-memory.dmp

                          Filesize

                          452KB

                        • memory/2792-191-0x00000269E2330000-0x00000269E23A1000-memory.dmp

                          Filesize

                          452KB

                        • memory/2792-153-0x00000269E1F00000-0x00000269E1F71000-memory.dmp

                          Filesize

                          452KB

                        • memory/3132-154-0x00000279D4930000-0x00000279D49A1000-memory.dmp

                          Filesize

                          452KB

                        • memory/3132-180-0x00000279D49E0000-0x00000279D49FA000-memory.dmp

                          Filesize

                          104KB

                        • memory/3132-179-0x00000279D7100000-0x00000279D7206000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/4588-150-0x000001CB7FA90000-0x000001CB7FB01000-memory.dmp

                          Filesize

                          452KB

                        • memory/4588-122-0x000001CB7F9D0000-0x000001CB7FA1B000-memory.dmp

                          Filesize

                          300KB

                        • memory/4984-119-0x0000000004830000-0x000000000488C000-memory.dmp

                          Filesize

                          368KB

                        • memory/4984-118-0x0000000002F23000-0x0000000003024000-memory.dmp

                          Filesize

                          1.0MB