plugx | 704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f

General

Target

704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe
Size

1.8MB
MD5

66a22d6297647aa45056ce1410befd39
SHA1

05d13a6b47f13fa9e49e9bc95291562afa46c2a6
SHA256

704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f
SHA512

212efaa509f2e70c68236ce6a484ec43e804cdda902fc33c70b3e872061c56d2620c0ab164b74157c1d8cfe06a8fe0a89e67d5b84a48265329d08a9f524efda1

Score

10^/10

plugx persistence trojan

Malware Config

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

PlugX Rat Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1332-91-0x0000000071A90000-0x0000000072E1F000-memory.dmp	PlugX

Executes dropped EXE 2 IoCs

pid	Process
1072	JLEGIO~1.EXE
1332	UtilitesFree.exe

Loads dropped DLL 3 IoCs

pid	Process
1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe
1072	JLEGIO~1.EXE
1072	JLEGIO~1.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: 33	1072	JLEGIO~1.EXE
Token: SeIncBasePriorityPrivilege	1072	JLEGIO~1.EXE
Token: 33	1072	JLEGIO~1.EXE
Token: SeIncBasePriorityPrivilege	1072	JLEGIO~1.EXE
Token: 33	1332	UtilitesFree.exe
Token: SeIncBasePriorityPrivilege	1332	UtilitesFree.exe
Token: 33	1332	UtilitesFree.exe
Token: SeIncBasePriorityPrivilege	1332	UtilitesFree.exe
Token: 33	1332	UtilitesFree.exe
Token: SeIncBasePriorityPrivilege	1332	UtilitesFree.exe
Token: SeDebugPrivilege	1332	UtilitesFree.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 1072	1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe	27
PID 1052 wrote to memory of 1072	1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe	27
PID 1052 wrote to memory of 1072	1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe	27
PID 1052 wrote to memory of 1072	1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe	27
PID 1052 wrote to memory of 1072	1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe	27
PID 1052 wrote to memory of 1072	1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe	27
PID 1052 wrote to memory of 1072	1052	704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe	27
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28
PID 1072 wrote to memory of 1332	1072	JLEGIO~1.EXE	28

C:\Users\Admin\AppData\Local\Temp\704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe
"C:\Users\Admin\AppData\Local\Temp\704c5fbb5766bca421e96cbfe0b4670a05fb2f09680983c2a681d45354d1421f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JLEGIO~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JLEGIO~1.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Users\Admin\AppData\Local\Spoon\Sandbox\UtilitesFree by JLeGioH\1.0.0.1\local\stubexe\0xAD1D2C5578541929\UtilitesFree.exe
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UtilitesFree.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1052-54-0x00000000753E1000-0x00000000753E3000-memory.dmp

Filesize
8KB

Download
memory/1072-68-0x0000000002080000-0x000000000213A000-memory.dmp

Filesize
744KB

Download
memory/1072-66-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1072-69-0x0000000077100000-0x0000000077280000-memory.dmp

Filesize
1.5MB

Download
memory/1072-70-0x0000000054BC0000-0x0000000054BC1000-memory.dmp

Filesize
4KB

Download
memory/1072-71-0x0000000077100000-0x0000000077280000-memory.dmp

Filesize
1.5MB

Download
memory/1072-72-0x0000000077100000-0x0000000077280000-memory.dmp

Filesize
1.5MB

Download
memory/1072-73-0x0000000076930000-0x0000000076977000-memory.dmp

Filesize
284KB

Download
memory/1072-74-0x0000000000240000-0x00000000002FE000-memory.dmp

Filesize
760KB

Download
memory/1072-64-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1072-62-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1072-60-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1332-91-0x0000000071A90000-0x0000000072E1F000-memory.dmp

Filesize
19.6MB

Download
memory/1332-97-0x0000000072E20000-0x000000007350E000-memory.dmp

Filesize
6.9MB

Download
memory/1332-89-0x0000000073EB0000-0x0000000073EFA000-memory.dmp

Filesize
296KB

Download
memory/1332-90-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1332-88-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1332-92-0x0000000000B70000-0x0000000000C2A000-memory.dmp

Filesize
744KB

Download
memory/1332-93-0x0000000077100000-0x0000000077280000-memory.dmp

Filesize
1.5MB

Download
memory/1332-95-0x0000000076930000-0x0000000076977000-memory.dmp

Filesize
284KB

Download
memory/1332-96-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1332-87-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/1332-94-0x0000000071080000-0x0000000071A90000-memory.dmp

Filesize
10.1MB

Download
memory/1332-98-0x0000000073B10000-0x0000000073CA4000-memory.dmp

Filesize
1.6MB

Download
memory/1332-99-0x0000000070360000-0x000000007107D000-memory.dmp

Filesize
13.1MB

Download
memory/1332-100-0x000000006FB80000-0x0000000070360000-memory.dmp

Filesize
7.9MB

Download
memory/1332-101-0x0000000073A10000-0x0000000073B0C000-memory.dmp

Filesize
1008KB

Download
memory/1332-102-0x000000006F440000-0x000000006FB7E000-memory.dmp

Filesize
7.2MB

Download
memory/1332-103-0x0000000005320000-0x0000000005321000-memory.dmp

Filesize
4KB

Download
memory/1332-104-0x0000000005325000-0x0000000005336000-memory.dmp

Filesize
68KB

Download
memory/1332-105-0x0000000054BC0000-0x0000000054BC1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing