plugx | 3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8

Analysis

max time kernel
42s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-06-2022 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe
Size

364KB
MD5

3bdcd75949bc028311649557395aad17
SHA1

7c1c010814a2308891a54a095fa2b57a178b9bc6
SHA256

3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8
SHA512

2edaf28d957a23bf3cef4df128fef096bc71a07adcc45028d05740392328619c37ac008b3e3303457d3598c9fd3638ee980511010311a903d96dfa85eb34d9ab

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX Payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2036-67-0x0000000000290000-0x00000000002C1000-memory.dmp	family_plugx
behavioral1/memory/1692-77-0x0000000001CA0000-0x0000000001CD1000-memory.dmp	family_plugx
behavioral1/memory/1800-79-0x0000000000200000-0x0000000000231000-memory.dmp	family_plugx
behavioral1/memory/1800-84-0x0000000000200000-0x0000000000231000-memory.dmp	family_plugx
behavioral1/memory/636-86-0x0000000000290000-0x00000000002C1000-memory.dmp	family_plugx
behavioral1/memory/636-87-0x0000000000290000-0x00000000002C1000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 2 IoCs

Processes:

mcvsmap.exemcvsmap.exe

pid process

2036 mcvsmap.exe
1692 mcvsmap.exe
Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1800 svchost.exe

pid	process
2036	mcvsmap.exe
1692	mcvsmap.exe

pid	process
1800	svchost.exe

Loads dropped DLL 6 IoCs

Processes:

3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exemcvsmap.exemcvsmap.exe

pid	process
1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe
1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe
1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe
1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe
2036	mcvsmap.exe
1692	mcvsmap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 34003100340037004100310039004200320033003200410037003200360031000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

svchost.exemsiexec.exe

pid process

1800 svchost.exe
1800 svchost.exe
1800 svchost.exe
1800 svchost.exe
636 msiexec.exe

pid	process
1800	svchost.exe
1800	svchost.exe
1800	svchost.exe
1800	svchost.exe
636	msiexec.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

mcvsmap.exemcvsmap.exesvchost.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2036	mcvsmap.exe
Token: SeTcbPrivilege	2036	mcvsmap.exe
Token: SeDebugPrivilege	1692	mcvsmap.exe
Token: SeTcbPrivilege	1692	mcvsmap.exe
Token: SeDebugPrivilege	1800	svchost.exe
Token: SeTcbPrivilege	1800	svchost.exe
Token: SeDebugPrivilege	636	msiexec.exe
Token: SeTcbPrivilege	636	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exemcvsmap.exesvchost.exe

description	pid	process	target process
PID 1908 wrote to memory of 2036	1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe	mcvsmap.exe
PID 1908 wrote to memory of 2036	1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe	mcvsmap.exe
PID 1908 wrote to memory of 2036	1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe	mcvsmap.exe
PID 1908 wrote to memory of 2036	1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe	mcvsmap.exe
PID 1908 wrote to memory of 2036	1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe	mcvsmap.exe
PID 1908 wrote to memory of 2036	1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe	mcvsmap.exe
PID 1908 wrote to memory of 2036	1908	3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe	mcvsmap.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1692 wrote to memory of 1800	1692	mcvsmap.exe	svchost.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe
PID 1800 wrote to memory of 636	1800	svchost.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe
"C:\Users\Admin\AppData\Local\Temp\3a6f18436a355dccb1b0baa715824e201bfbe0307683e7f726b33bee4fd2c2b8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\ProgramData\VirusMap\mcvsmap.exe
C:\ProgramData\VirusMap\mcvsmap.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe 201 0
2⤵
- Deletes itself
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\system32\msiexec.exe 209 1800
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:636

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\bug.log
Filesize
456B

MD5
dffa40aa9c4b61a9dce550f9a55597ea

SHA1
b310a851571d7b6617515ccf64534c257069a690

SHA256
9eff4f6bdffe16932c50bb25cecb43e59947480af489cc4917c01ffd093794df

SHA512
23f7d4a37b56f42e094d80562b2b3a0f80eb7a6eae4110a30ab25be0b7920581fdc4b5640b7a818843add0d46f03f5d99f38337110ab4d8beac1c9a78a913120

Download Submit
C:\ProgramData\SxS\bug.log
Filesize
618B

MD5
c9face31f2f016905ce7d65997a17757

SHA1
6440b7748035a030fecacc0e3b74c75e5182920a

SHA256
c5c0c9173033f2d00d058a301a855cd73c1fb6a754476598167b1c644050d9ff

SHA512
7462981d9c96e6129f63f1745b3dc89745d11162d87d5917ace4f0ad6df0574caf35cbbbc17a555bbd80b791e74094ee89ea43440c65f66da1cd06bc6a05c103

Download Submit
C:\ProgramData\VirusMap\McUtil.dll
Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
C:\ProgramData\VirusMap\McUtil.dll.PPT
Filesize
121KB

MD5
6bbba1416a6f16da14bf93e15c417282

SHA1
8688eb1bed03797ff0b14376867712de27d85078

SHA256
5341ec0c5356057d480550068cd4ef0d49ccb5e113b39f044a934f6ce98be627

SHA512
3700940923a9cc584d07406b9b33dedc09ef0f4a33663d97dc3ca441bab43b0407228d135e729b9ce9493b66c66e4c69c54dbf0cfae99cf08848f1f1433eb27d

Download Submit
C:\ProgramData\VirusMap\mcvsmap.exe
Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll
Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll.PPT
Filesize
121KB

MD5
6bbba1416a6f16da14bf93e15c417282

SHA1
8688eb1bed03797ff0b14376867712de27d85078

SHA256
5341ec0c5356057d480550068cd4ef0d49ccb5e113b39f044a934f6ce98be627

SHA512
3700940923a9cc584d07406b9b33dedc09ef0f4a33663d97dc3ca441bab43b0407228d135e729b9ce9493b66c66e4c69c54dbf0cfae99cf08848f1f1433eb27d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\ProgramData\VirusMap\McUtil.DLL
Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.DLL
Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
memory/636-83-0x0000000000000000-mapping.dmp

Download
memory/636-86-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/636-87-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/1692-77-0x0000000001CA0000-0x0000000001CD1000-memory.dmp

Filesize
196KB

Download
memory/1800-75-0x0000000000000000-mapping.dmp

Download
memory/1800-79-0x0000000000200000-0x0000000000231000-memory.dmp

Filesize
196KB

Download
memory/1800-73-0x00000000000A0000-0x00000000000BD000-memory.dmp

Filesize
116KB

Download
memory/1800-84-0x0000000000200000-0x0000000000231000-memory.dmp

Filesize
196KB

Download
memory/1908-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/2036-67-0x0000000000290000-0x00000000002C1000-memory.dmp

Filesize
196KB

Download
memory/2036-66-0x0000000001E10000-0x0000000001F10000-memory.dmp

Filesize
1024KB

Download
memory/2036-59-0x0000000000000000-mapping.dmp

Download