Analysis
-
max time kernel
151s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
28-05-2022 02:43
Static task
static1
Behavioral task
behavioral1
Sample
66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967.dll
Resource
win7-20220414-en
General
-
Target
66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967.dll
-
Size
228KB
-
MD5
3c74a85c2cf883bd9d4b9f8b9746030f
-
SHA1
40541a03e910b21df681bec69cfe59678ebba86c
-
SHA256
66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967
-
SHA512
15ab0c68e1dc8f5dc87231942f008228fe658ce221efe0ba90dfbfedea7e9cf401cac37098674a1d7cd489c97d061b847f09b86c24453575e2d46d4d9326e29c
Malware Config
Signatures
-
Detects PlugX Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1336-69-0x0000000000280000-0x00000000002B0000-memory.dmp family_plugx behavioral1/memory/2044-80-0x0000000000440000-0x0000000000470000-memory.dmp family_plugx behavioral1/memory/568-81-0x0000000000200000-0x0000000000230000-memory.dmp family_plugx behavioral1/memory/1980-86-0x00000000008D0000-0x0000000000900000-memory.dmp family_plugx behavioral1/memory/568-87-0x0000000000200000-0x0000000000230000-memory.dmp family_plugx behavioral1/memory/1980-88-0x00000000008D0000-0x0000000000900000-memory.dmp family_plugx -
Executes dropped EXE 3 IoCs
Processes:
5BB8.tmpGadget.exeGadget.exepid process 904 5BB8.tmp 1336 Gadget.exe 2044 Gadget.exe -
Loads dropped DLL 5 IoCs
Processes:
rundll32.exe5BB8.tmpGadget.exeGadget.exepid process 1008 rundll32.exe 1008 rundll32.exe 904 5BB8.tmp 1336 Gadget.exe 2044 Gadget.exe -
Modifies data under HKEY_USERS 20 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70} svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDecisionTime = 605fcfb16372d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDecisionTime = 4059c2c66372d801 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\aa-fa-e1-da-f9-89 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDetectedUrl svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadDecisionTime = 605fcfb16372d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadDecisionTime = 4059c2c66372d801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadDecisionTime = a07ed09c6372d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDecisionTime = a07ed09c6372d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadDecisionTime = e0cfc7aa6372d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadDecisionTime = 2040cec66372d801 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDecisionTime = 2040cec66372d801 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadDecision = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F01AEAEC-EBE0-4244-A339-7F4A81A39B70}\WpadNetworkName = "Network 3" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-fa-e1-da-f9-89\WpadDecisionTime = e0cfc7aa6372d801 svchost.exe -
Modifies registry class 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 42004500340038004100440030004200430032004100340041003600430034000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exemsiexec.exepid process 568 svchost.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 1980 msiexec.exe 568 svchost.exe 568 svchost.exe 1980 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Gadget.exeGadget.exesvchost.exemsiexec.exedescription pid process Token: SeDebugPrivilege 1336 Gadget.exe Token: SeTcbPrivilege 1336 Gadget.exe Token: SeDebugPrivilege 2044 Gadget.exe Token: SeTcbPrivilege 2044 Gadget.exe Token: SeDebugPrivilege 568 svchost.exe Token: SeTcbPrivilege 568 svchost.exe Token: SeDebugPrivilege 1980 msiexec.exe Token: SeTcbPrivilege 1980 msiexec.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
rundll32.exerundll32.exe5BB8.tmpGadget.exesvchost.exedescription pid process target process PID 1904 wrote to memory of 1008 1904 rundll32.exe rundll32.exe PID 1904 wrote to memory of 1008 1904 rundll32.exe rundll32.exe PID 1904 wrote to memory of 1008 1904 rundll32.exe rundll32.exe PID 1904 wrote to memory of 1008 1904 rundll32.exe rundll32.exe PID 1904 wrote to memory of 1008 1904 rundll32.exe rundll32.exe PID 1904 wrote to memory of 1008 1904 rundll32.exe rundll32.exe PID 1904 wrote to memory of 1008 1904 rundll32.exe rundll32.exe PID 1008 wrote to memory of 904 1008 rundll32.exe 5BB8.tmp PID 1008 wrote to memory of 904 1008 rundll32.exe 5BB8.tmp PID 1008 wrote to memory of 904 1008 rundll32.exe 5BB8.tmp PID 1008 wrote to memory of 904 1008 rundll32.exe 5BB8.tmp PID 904 wrote to memory of 1336 904 5BB8.tmp Gadget.exe PID 904 wrote to memory of 1336 904 5BB8.tmp Gadget.exe PID 904 wrote to memory of 1336 904 5BB8.tmp Gadget.exe PID 904 wrote to memory of 1336 904 5BB8.tmp Gadget.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 2044 wrote to memory of 568 2044 Gadget.exe svchost.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe PID 568 wrote to memory of 1980 568 svchost.exe msiexec.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967.dll,#12⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5BB8.tmpC:\Users\Admin\AppData\Local\Temp\5BB8.tmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Gadget.exeC:\Users\Admin\AppData\Local\Temp\\Gadget.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\WS\Gadget.exeC:\ProgramData\WS\Gadget.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 5683⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\WS\Gadget.exeFilesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
C:\ProgramData\WS\SideBar.dllFilesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
-
C:\ProgramData\WS\SideBar.dll.docFilesize
121KB
MD597c11e7d6b1926cd4be13804b36239ac
SHA1b388b86a782ae14fee2a31bc7626a816c3eabc5a
SHA256a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a
SHA5128ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121
-
C:\Users\Admin\AppData\Local\Temp\5BB8.tmpFilesize
225KB
MD5c116cd083284cc599c024c3479ca9b70
SHA1bf831962162a0446454e3e32d764cc0e5daafde0
SHA25690a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84
SHA512d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560
-
C:\Users\Admin\AppData\Local\Temp\5BB8.tmpFilesize
225KB
MD5c116cd083284cc599c024c3479ca9b70
SHA1bf831962162a0446454e3e32d764cc0e5daafde0
SHA25690a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84
SHA512d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560
-
C:\Users\Admin\AppData\Local\Temp\Gadget.exeFilesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
C:\Users\Admin\AppData\Local\Temp\Gadget.exeFilesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
C:\Users\Admin\AppData\Local\Temp\SideBar.dllFilesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
-
C:\Users\Admin\AppData\Local\Temp\SideBar.dll.docFilesize
121KB
MD597c11e7d6b1926cd4be13804b36239ac
SHA1b388b86a782ae14fee2a31bc7626a816c3eabc5a
SHA256a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a
SHA5128ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121
-
\ProgramData\WS\SideBar.dllFilesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
-
\Users\Admin\AppData\Local\Temp\5BB8.tmpFilesize
225KB
MD5c116cd083284cc599c024c3479ca9b70
SHA1bf831962162a0446454e3e32d764cc0e5daafde0
SHA25690a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84
SHA512d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560
-
\Users\Admin\AppData\Local\Temp\5BB8.tmpFilesize
225KB
MD5c116cd083284cc599c024c3479ca9b70
SHA1bf831962162a0446454e3e32d764cc0e5daafde0
SHA25690a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84
SHA512d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560
-
\Users\Admin\AppData\Local\Temp\Gadget.exeFilesize
25KB
MD56b97b3cd2fcfb4b74985143230441463
SHA18985c2394ed9a58c36f907962b0724fe66c204a6
SHA2565c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
SHA512736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
-
\Users\Admin\AppData\Local\Temp\Sidebar.dllFilesize
41KB
MD5901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA18bb71adf1c418061510c40240852c3cd61fb214c
SHA2563144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
SHA5126500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
-
memory/568-81-0x0000000000200000-0x0000000000230000-memory.dmpFilesize
192KB
-
memory/568-87-0x0000000000200000-0x0000000000230000-memory.dmpFilesize
192KB
-
memory/568-75-0x00000000000A0000-0x00000000000BD000-memory.dmpFilesize
116KB
-
memory/568-77-0x0000000000000000-mapping.dmp
-
memory/904-58-0x0000000000000000-mapping.dmp
-
memory/1008-54-0x0000000000000000-mapping.dmp
-
memory/1008-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1336-61-0x0000000000000000-mapping.dmp
-
memory/1336-69-0x0000000000280000-0x00000000002B0000-memory.dmpFilesize
192KB
-
memory/1336-68-0x0000000000410000-0x0000000000510000-memory.dmpFilesize
1024KB
-
memory/1980-84-0x0000000000000000-mapping.dmp
-
memory/1980-86-0x00000000008D0000-0x0000000000900000-memory.dmpFilesize
192KB
-
memory/1980-88-0x00000000008D0000-0x0000000000900000-memory.dmpFilesize
192KB
-
memory/2044-80-0x0000000000440000-0x0000000000470000-memory.dmpFilesize
192KB