plugx | ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34

Analysis

max time kernel
168s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34.exe
Size

428KB
MD5

50742b582157e9fc58924153a743110f
SHA1

04a0e43fd70ba637fc451499b36be5dedd6a8f54
SHA256

ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34
SHA512

5e823eddefba625f304234b8588186e2c1b43941739e460949a92a43db4f68f6fc19acff3bbe7066556f067c00eac25875efc92466a78e31e6c06f06e151d520

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX Payload 8 IoCs

resource	yara_rule
behavioral2/memory/2292-137-0x0000000002340000-0x000000000236E000-memory.dmp	family_plugx
behavioral2/memory/2016-148-0x00000000021E0000-0x000000000220E000-memory.dmp	family_plugx
behavioral2/memory/4384-149-0x0000000000DB0000-0x0000000000DDE000-memory.dmp	family_plugx
behavioral2/memory/1428-150-0x0000000001470000-0x000000000149E000-memory.dmp	family_plugx
behavioral2/memory/1428-151-0x0000000001470000-0x000000000149E000-memory.dmp	family_plugx
behavioral2/memory/2016-153-0x00000000021E0000-0x000000000220E000-memory.dmp	family_plugx
behavioral2/memory/116-155-0x0000000000760000-0x000000000078E000-memory.dmp	family_plugx
behavioral2/memory/116-157-0x0000000000760000-0x000000000078E000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Executes dropped EXE 3 IoCs

pid	Process
2292	360.exe
2016	360.exe
4384	360.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34.exe

Loads dropped DLL 3 IoCs

pid	Process
2292	360.exe
2016	360.exe
4384	360.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 37003300340033004400410038003100460037004400320032004300340038000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2292	360.exe
2292	360.exe
1428	svchost.exe
1428	svchost.exe
1428	svchost.exe
1428	svchost.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
1428	svchost.exe
1428	svchost.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
1428	svchost.exe
1428	svchost.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
1428	svchost.exe
1428	svchost.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
1428	svchost.exe
1428	svchost.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe
116	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1428	svchost.exe
116	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	2292	360.exe
Token: SeTcbPrivilege	2292	360.exe
Token: SeDebugPrivilege	2016	360.exe
Token: SeTcbPrivilege	2016	360.exe
Token: SeDebugPrivilege	4384	360.exe
Token: SeTcbPrivilege	4384	360.exe
Token: SeDebugPrivilege	1428	svchost.exe
Token: SeTcbPrivilege	1428	svchost.exe
Token: SeDebugPrivilege	116	msiexec.exe
Token: SeTcbPrivilege	116	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 2292	3108	ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34.exe	80
PID 3108 wrote to memory of 2292	3108	ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34.exe	80
PID 3108 wrote to memory of 2292	3108	ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34.exe	80
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 4384 wrote to memory of 1428	4384	360.exe	84
PID 1428 wrote to memory of 116	1428	svchost.exe	86
PID 1428 wrote to memory of 116	1428	svchost.exe	86
PID 1428 wrote to memory of 116	1428	svchost.exe	86
PID 1428 wrote to memory of 116	1428	svchost.exe	86
PID 1428 wrote to memory of 116	1428	svchost.exe	86
PID 1428 wrote to memory of 116	1428	svchost.exe	86
PID 1428 wrote to memory of 116	1428	svchost.exe	86
PID 1428 wrote to memory of 116	1428	svchost.exe	86

C:\Users\Admin\AppData\Local\Temp\ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34.exe
"C:\Users\Admin\AppData\Local\Temp\ea257be88094028e9adf2422124491f2ab71c3359d54d5db0d2829de22e16b34.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292

C:\ProgramData\360\360.exe
"C:\ProgramData\360\360.exe" 100 2292
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\ProgramData\360\360.exe
"C:\ProgramData\360\360.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 1428
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\360\360.exe

Filesize
437KB

MD5
e72ec6011d88822322677c9de75a3eaa

SHA1
bde02d9b2b69960d6f16ea3b867861fe5515c844

SHA256
93efac9c96d5a1cab41efe1c96b3ada7ee5eff6014b1ca68ff087a8154e2f16b

SHA512
d4fe25b7718a348bd6988aac4a31d1ea0f314f32bd2f5d30efecab6b076d19a5a18c66eb477afc32691717432a83b38f22c2be8ee477dba6d5d0794f01d8e22c

Download Submit
C:\ProgramData\360\360.exe

Filesize
437KB

MD5
e72ec6011d88822322677c9de75a3eaa

SHA1
bde02d9b2b69960d6f16ea3b867861fe5515c844

SHA256
93efac9c96d5a1cab41efe1c96b3ada7ee5eff6014b1ca68ff087a8154e2f16b

SHA512
d4fe25b7718a348bd6988aac4a31d1ea0f314f32bd2f5d30efecab6b076d19a5a18c66eb477afc32691717432a83b38f22c2be8ee477dba6d5d0794f01d8e22c

Download Submit
C:\ProgramData\360\360.exe

Filesize
437KB

MD5
e72ec6011d88822322677c9de75a3eaa

SHA1
bde02d9b2b69960d6f16ea3b867861fe5515c844

SHA256
93efac9c96d5a1cab41efe1c96b3ada7ee5eff6014b1ca68ff087a8154e2f16b

SHA512
d4fe25b7718a348bd6988aac4a31d1ea0f314f32bd2f5d30efecab6b076d19a5a18c66eb477afc32691717432a83b38f22c2be8ee477dba6d5d0794f01d8e22c

Download Submit
C:\ProgramData\360\360.fuck

Filesize
113KB

MD5
a44015ae345f71e289b2fcff4d0f92f6

SHA1
ecab144a308ee3fe4ff2e209720eebfb05483b15

SHA256
4414510e363b2c43a8af71b40f3a8bd69a82641e355cdbb7ae3c5cbcb42cf875

SHA512
9b49563f1156c096a15975a6f16dd5aa9b628108d474bd41a72dd3d1be6973acdae95359a127ee217fb1028db6167f6db1705dc45d59468de31065a70cf0be9c

Download Submit
C:\ProgramData\360\D3DX81ab.dll

Filesize
41KB

MD5
a70146aab8500e03056405c5f97da432

SHA1
21dbc18a6fdee9ce06e388be7475eb6141d92d20

SHA256
4d717e65d83f608f67c345d840fb8b1bedebffe40b681a1a4a57acc011396839

SHA512
9539f6854572df173af1b38d28c98456d0966e7e84ba8cdfd45a3e6d7a2b743572b254ede137a307c8a9b69f6df1838613b47509b9feb348f0a9579cbc1eae82

Download Submit
C:\ProgramData\360\D3DX81ab.dll

Filesize
41KB

MD5
a70146aab8500e03056405c5f97da432

SHA1
21dbc18a6fdee9ce06e388be7475eb6141d92d20

SHA256
4d717e65d83f608f67c345d840fb8b1bedebffe40b681a1a4a57acc011396839

SHA512
9539f6854572df173af1b38d28c98456d0966e7e84ba8cdfd45a3e6d7a2b743572b254ede137a307c8a9b69f6df1838613b47509b9feb348f0a9579cbc1eae82

Download Submit
C:\ProgramData\360\D3DX81ab.dll

Filesize
41KB

MD5
a70146aab8500e03056405c5f97da432

SHA1
21dbc18a6fdee9ce06e388be7475eb6141d92d20

SHA256
4d717e65d83f608f67c345d840fb8b1bedebffe40b681a1a4a57acc011396839

SHA512
9539f6854572df173af1b38d28c98456d0966e7e84ba8cdfd45a3e6d7a2b743572b254ede137a307c8a9b69f6df1838613b47509b9feb348f0a9579cbc1eae82

Download Submit
C:\ProgramData\SxS\bug.log

Filesize
456B

MD5
f98a4579fdc7d0e7c1a6e9fe3d6cbe15

SHA1
6d22318802444948c17d9c8d912a40598ee3b1f5

SHA256
043730ce7581186daa2e746cd044039d3bb51ae8a1d8fe98f0e93b83663b3f14

SHA512
9f6631cb4c8e60623ac6ed67678181f231beb1057d304b72b74cd10d00c9beff991c6462aea3322c2c6cab7448c4fd94bd27b9bc5cffde7a466e7b4beeb06c29

Download Submit
C:\ProgramData\SxS\bug.log

Filesize
598B

MD5
afb0c7dfd73bd3e85b2943a3cde98db6

SHA1
9e8d7517df2783a228ba49809892d3c4cd6b211e

SHA256
0cd78efb8e652ed9e8d8f791008a0c0beb1b4091a84afc0601b6095f124c9980

SHA512
b3cca69405f1a092b9d38356058533c2e8234e7d723b20f05c768f1a5ef389efdf39bc028a1f0852e1a7ff1f1417ebc969b7f1a290350526d0f76e52c1187a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe

Filesize
437KB

MD5
e72ec6011d88822322677c9de75a3eaa

SHA1
bde02d9b2b69960d6f16ea3b867861fe5515c844

SHA256
93efac9c96d5a1cab41efe1c96b3ada7ee5eff6014b1ca68ff087a8154e2f16b

SHA512
d4fe25b7718a348bd6988aac4a31d1ea0f314f32bd2f5d30efecab6b076d19a5a18c66eb477afc32691717432a83b38f22c2be8ee477dba6d5d0794f01d8e22c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe

Filesize
437KB

MD5
e72ec6011d88822322677c9de75a3eaa

SHA1
bde02d9b2b69960d6f16ea3b867861fe5515c844

SHA256
93efac9c96d5a1cab41efe1c96b3ada7ee5eff6014b1ca68ff087a8154e2f16b

SHA512
d4fe25b7718a348bd6988aac4a31d1ea0f314f32bd2f5d30efecab6b076d19a5a18c66eb477afc32691717432a83b38f22c2be8ee477dba6d5d0794f01d8e22c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.fuck

Filesize
113KB

MD5
a44015ae345f71e289b2fcff4d0f92f6

SHA1
ecab144a308ee3fe4ff2e209720eebfb05483b15

SHA256
4414510e363b2c43a8af71b40f3a8bd69a82641e355cdbb7ae3c5cbcb42cf875

SHA512
9b49563f1156c096a15975a6f16dd5aa9b628108d474bd41a72dd3d1be6973acdae95359a127ee217fb1028db6167f6db1705dc45d59468de31065a70cf0be9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\D3DX81ab.dll

Filesize
41KB

MD5
a70146aab8500e03056405c5f97da432

SHA1
21dbc18a6fdee9ce06e388be7475eb6141d92d20

SHA256
4d717e65d83f608f67c345d840fb8b1bedebffe40b681a1a4a57acc011396839

SHA512
9539f6854572df173af1b38d28c98456d0966e7e84ba8cdfd45a3e6d7a2b743572b254ede137a307c8a9b69f6df1838613b47509b9feb348f0a9579cbc1eae82

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\D3DX81ab.dll

Filesize
41KB

MD5
a70146aab8500e03056405c5f97da432

SHA1
21dbc18a6fdee9ce06e388be7475eb6141d92d20

SHA256
4d717e65d83f608f67c345d840fb8b1bedebffe40b681a1a4a57acc011396839

SHA512
9539f6854572df173af1b38d28c98456d0966e7e84ba8cdfd45a3e6d7a2b743572b254ede137a307c8a9b69f6df1838613b47509b9feb348f0a9579cbc1eae82

Download Submit
memory/116-157-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/116-155-0x0000000000760000-0x000000000078E000-memory.dmp

Filesize
184KB

Download
memory/1428-150-0x0000000001470000-0x000000000149E000-memory.dmp

Filesize
184KB

Download
memory/1428-151-0x0000000001470000-0x000000000149E000-memory.dmp

Filesize
184KB

Download
memory/2016-153-0x00000000021E0000-0x000000000220E000-memory.dmp

Filesize
184KB

Download
memory/2016-148-0x00000000021E0000-0x000000000220E000-memory.dmp

Filesize
184KB

Download
memory/2292-137-0x0000000002340000-0x000000000236E000-memory.dmp

Filesize
184KB

Download
memory/2292-136-0x00000000021D0000-0x00000000022D0000-memory.dmp

Filesize
1024KB

Download
memory/4384-149-0x0000000000DB0000-0x0000000000DDE000-memory.dmp

Filesize
184KB

Download