Resubmissions

26-04-2022 23:36

220426-3lkvdaegb6 10

28-02-2022 15:52

220228-tbeqyagaar 10

24-02-2022 11:16

220224-ndfs5aebfn 9

27-07-2021 22:10

210727-kkvgchhhls 10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-07-2021 22:10

General

  • Target

    80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967.bin.exe

  • Size

    426KB

  • MD5

    048271f7f2f8d900485dd020cdea2dd9

  • SHA1

    fc48ae44addc9e1d00238f5ba798f3876e69c561

  • SHA256

    80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967

  • SHA512

    aa21ba3fde629857934140fb96737189602242222f4f26d7a9b28f28c52a4bc91c046eaaaf11472c2f73ff126697d6e57a2b3d36bf84ed17d3c80e9c629ea5df

Score
10/10

Malware Config

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • PlugX Rat Payload 3 IoCs
  • ACProtect 1.3x - 1.4x DLL software 4 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\80deed939a520696968335d1bb2a9fcce7053c0156f679ba261824d0a2d44967.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4436
    • \??\c:\windows\temp\AROTutorial.exe
      c:\windows\temp\AROTutorial.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4624
  • C:\ProgramData\ARO\AROTutorial.exe
    "C:\ProgramData\ARO\AROTutorial.exe" 600 0
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe 601 0
      2⤵
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4864
      • C:\Windows\SysWOW64\userinit.exe
        C:\Windows\system32\userinit.exe 609 4864
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\ARO\AROTutorial.exe
    MD5

    64ff0a8730472e36e62ce29a20f61529

    SHA1

    6e8165999acf896e27db0da266a96189efd335e8

    SHA256

    18a98c2d905a1da1d9d855e86866921e543f4bf8621faea05eb14d8e5b23b60c

    SHA512

    46375849a493445f3ac1e757321a02d19822d79e866fac6ab19a99c01f0ec38e70b5c8eb6bf32ddef8d86f046b22a036ded4929a6a0b5b123261d9828b675c6d

  • C:\ProgramData\ARO\AROTutorial.exe
    MD5

    64ff0a8730472e36e62ce29a20f61529

    SHA1

    6e8165999acf896e27db0da266a96189efd335e8

    SHA256

    18a98c2d905a1da1d9d855e86866921e543f4bf8621faea05eb14d8e5b23b60c

    SHA512

    46375849a493445f3ac1e757321a02d19822d79e866fac6ab19a99c01f0ec38e70b5c8eb6bf32ddef8d86f046b22a036ded4929a6a0b5b123261d9828b675c6d

  • C:\ProgramData\ARO\aross.dat
    MD5

    60e04d5b3dae8bcd3cfa82d492088869

    SHA1

    4ccb79d805fd92db08269c2a5cbf40dd94fb1f3b

    SHA256

    c5dcd3073904fad5d9a8fe1026141a832e05c9ca03a88fee96587921f42773d4

    SHA512

    0b45cba9df6ec8e355ce412793d900142ee90c7bdc9d5a6e4d33dd48de40f027646344c70501ca914b250ca42a766c2d035152bf29d07bf913915a93f23312cb

  • C:\ProgramData\ARO\aross.dll
    MD5

    9b05caf01254dbd3389ab74d9932ed37

    SHA1

    7fe8de80c04124b84b800cd284173d86aabedb5e

    SHA256

    f78bf6711b6f3f24573f2a22804f33cec6741f3f2db449410fa37430021080ab

    SHA512

    8d35ceae212b203df810010ace168349c4f2488fcc8e0f08d998958b4ea3d120413bf625da729043a52b07e77ee39a2bf86128e3124293a47a9a71b59f30a28b

  • C:\Windows\Temp\AROTutorial.exe
    MD5

    64ff0a8730472e36e62ce29a20f61529

    SHA1

    6e8165999acf896e27db0da266a96189efd335e8

    SHA256

    18a98c2d905a1da1d9d855e86866921e543f4bf8621faea05eb14d8e5b23b60c

    SHA512

    46375849a493445f3ac1e757321a02d19822d79e866fac6ab19a99c01f0ec38e70b5c8eb6bf32ddef8d86f046b22a036ded4929a6a0b5b123261d9828b675c6d

  • \??\c:\windows\temp\AROTutorial.exe
    MD5

    64ff0a8730472e36e62ce29a20f61529

    SHA1

    6e8165999acf896e27db0da266a96189efd335e8

    SHA256

    18a98c2d905a1da1d9d855e86866921e543f4bf8621faea05eb14d8e5b23b60c

    SHA512

    46375849a493445f3ac1e757321a02d19822d79e866fac6ab19a99c01f0ec38e70b5c8eb6bf32ddef8d86f046b22a036ded4929a6a0b5b123261d9828b675c6d

  • \??\c:\windows\temp\aross.dat
    MD5

    60e04d5b3dae8bcd3cfa82d492088869

    SHA1

    4ccb79d805fd92db08269c2a5cbf40dd94fb1f3b

    SHA256

    c5dcd3073904fad5d9a8fe1026141a832e05c9ca03a88fee96587921f42773d4

    SHA512

    0b45cba9df6ec8e355ce412793d900142ee90c7bdc9d5a6e4d33dd48de40f027646344c70501ca914b250ca42a766c2d035152bf29d07bf913915a93f23312cb

  • \??\c:\windows\temp\aross.dll
    MD5

    9b05caf01254dbd3389ab74d9932ed37

    SHA1

    7fe8de80c04124b84b800cd284173d86aabedb5e

    SHA256

    f78bf6711b6f3f24573f2a22804f33cec6741f3f2db449410fa37430021080ab

    SHA512

    8d35ceae212b203df810010ace168349c4f2488fcc8e0f08d998958b4ea3d120413bf625da729043a52b07e77ee39a2bf86128e3124293a47a9a71b59f30a28b

  • \ProgramData\ARO\aross.dll
    MD5

    9b05caf01254dbd3389ab74d9932ed37

    SHA1

    7fe8de80c04124b84b800cd284173d86aabedb5e

    SHA256

    f78bf6711b6f3f24573f2a22804f33cec6741f3f2db449410fa37430021080ab

    SHA512

    8d35ceae212b203df810010ace168349c4f2488fcc8e0f08d998958b4ea3d120413bf625da729043a52b07e77ee39a2bf86128e3124293a47a9a71b59f30a28b

  • \Windows\Temp\aross.dll
    MD5

    9b05caf01254dbd3389ab74d9932ed37

    SHA1

    7fe8de80c04124b84b800cd284173d86aabedb5e

    SHA256

    f78bf6711b6f3f24573f2a22804f33cec6741f3f2db449410fa37430021080ab

    SHA512

    8d35ceae212b203df810010ace168349c4f2488fcc8e0f08d998958b4ea3d120413bf625da729043a52b07e77ee39a2bf86128e3124293a47a9a71b59f30a28b

  • memory/4060-133-0x0000000000000000-mapping.dmp
  • memory/4060-134-0x0000000003480000-0x00000000034BF000-memory.dmp
    Filesize

    252KB

  • memory/4624-114-0x0000000000000000-mapping.dmp
  • memory/4624-127-0x0000000000490000-0x00000000005DA000-memory.dmp
    Filesize

    1MB

  • memory/4624-128-0x0000000001FE0000-0x000000000201F000-memory.dmp
    Filesize

    252KB

  • memory/4772-129-0x0000000000580000-0x00000000005A5000-memory.dmp
    Filesize

    148KB

  • memory/4772-130-0x0000000000C90000-0x0000000000CCF000-memory.dmp
    Filesize

    252KB

  • memory/4864-125-0x0000000000000000-mapping.dmp
  • memory/4864-131-0x0000000002ED0000-0x0000000002ED2000-memory.dmp
    Filesize

    8KB

  • memory/4864-132-0x0000000003040000-0x00000000030EE000-memory.dmp
    Filesize

    696KB