plugx | wps_0000000001AA0000[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
wps_0000000001AA0000.dll
Size 208KB
Sample220720-wj74kaecdj
SHA256 527c776c2718e4e9be884d2b79c5a79a5cebf1512d04785c5949862c4bae7253
MD5 6c59df4af7127f69cfee1aba17cae985
SHA1 4ee6b1c68189e25d8c47ced7d0cbb29db484905a
SHA512 ec12a1b7ad44cfe3d135fbc3ee6b782d911f155481e6dab974e94a2246302af1d413b9d507df7e58e5c6e4d3e8bcc98eba8266fe7fbd71ad82a575df57e57fa0
SSDEEP 3072:UrYnRVsebiqxYJkbGZ3rBzsAMOu3cxSHzDxE7HgcP2y2yDJ+mdcAFGimFCpOgTwN:hVs0/yMA7uBE7HgcPlbHGl6h1X82I
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

plugx

Malware Config

Signatures

Detects PlugX payload 1 IoCs

resource	yara_rule
sample	family_plugx

Plugx family
plugx

File Explorer

wps_0000000001AA0000.dll

.dll 208KB

wps_0000000001AA0000.dll

IMPHASH cbac7ca641fd61e7ae8b266a3078d6c4
SHA256 527c776c2718e4e9be884d2b79c5a79a5cebf1512d04785c5949862c4bae7253
MD5 6c59df4af7127f69cfee1aba17cae985
SHA1 4ee6b1c68189e25d8c47ced7d0cbb29db484905a
SHA512 ec12a1b7ad44cfe3d135fbc3ee6b782d911f155481e6dab974e94a2246302af1d413b9d507df7e58e5c6e4d3e8bcc98eba8266fe7fbd71ad82a575df57e57fa0
SSDEEP 3072:UrYnRVsebiqxYJkbGZ3rBzsAMOu3cxSHzDxE7HgcP2y2yDJ+mdcAFGimFCpOgTwN:hVs0/yMA7uBE7HgcPlbHGl6h1X82I
MD5 SHA1 SHA512 SSDEEP

windows x64

Detects PlugX payload

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ResumeThread CreateFileMappingW MapViewOfFile VirtualProtect GetFileAttributesW SetErrorMode OpenFileMappingW SetFilePointer SetEndOfFile GlobalLock GetLocalTime GlobalUnlock QueryDosDeviceW GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW FindFirstFileW FindClose FindNextFileW FlushFileBuffers SetFileTime GetFileTime CreateDirectoryW ExpandEnvironmentStringsW GetProcessHeap HeapFree CopyFileW CreateThread WritePrivateProfileStringW ProcessIdToSessionId lstrcpyW QueryPerformanceFrequency QueryPerformanceCounter CreateNamedPipeW ConnectNamedPipe GetOverlappedResult GetConsoleCP FreeConsole GetModuleHandleA GetConsoleWindow AllocConsole SetConsoleCtrlHandler SetConsoleScreenBufferSize GetStdHandle WriteConsoleInputW GenerateConsoleCtrlEvent GetConsoleMode GetConsoleDisplayMode GetConsoleCursorInfo GetConsoleScreenBufferInfo ReadConsoleOutputW GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW GetModuleHandleW RemoveDirectoryW VirtualFreeEx lstrcpynA ResetEvent DisconnectNamedPipe lstrcmpA ExitThread LocalAlloc lstrcatW OutputDebugStringA LocalFree LocalLock LocalUnlock PostQueuedCompletionStatus LocalReAlloc CreateIoCompletionPort TerminateThread GetCurrentThread GetQueuedCompletionStatus QueueUserAPC GlobalMemoryStatus DeleteFileW WriteProcessMemory ReadProcessMemory OpenProcess GetVersionExW GetCurrentThreadId SetUnhandledExceptionFilter DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar WideCharToMultiByte lstrlenA lstrlenW WriteFile SetFileAttributesW ReadFile GetFileSize CreateFileW lstrcpyA lstrcmpW lstrcpynW WaitForMultipleObjects GetTickCount CreateEventW CreateProcessW GetCurrentProcessId lstrcmpiW ExitProcess GetCurrentProcess TerminateProcess GetLastError CreateRemoteThread VirtualAllocEx GetExitCodeThread VirtualFree VirtualAlloc LeaveCriticalSection EnterCriticalSection GetPrivateProfileIntW GetSystemDefaultLCID GetSystemInfo GetComputerNameW GetSystemTime CreateMutexW GetCommandLineW CloseHandle WaitForSingleObject SetEvent GetProcAddress LoadLibraryA GetConsoleOutputCP Sleep

user32

GetAsyncKeyState GetWindowThreadProcessId GetClassNameW GetWindowTextW GetForegroundWindow CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW CloseDesktop GetKeyState KillTimer DispatchMessageW TranslateMessage GetIconInfo DestroyIcon LoadCursorW GetMessageW SetTimer SetClipboardViewer CreateWindowExW CloseClipboard GetClipboardData WindowFromPoint SetCapture SetCursorPos mouse_event keybd_event OpenWindowStationW GetProcessWindowStation SetProcessWindowStation OpenInputDesktop GetThreadDesktop SetThreadDesktop CloseWindowStation PostMessageA ShowWindow wsprintfA CreateDesktopW IsClipboardFormatAvailable OpenClipboard DefWindowProcW SendMessageW PostQuitMessage ChangeClipboardChain GetSystemMetrics ExitWindowsEx MessageBoxW wsprintfW SetWindowLongPtrW

gdi32

CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap GdiFlush BitBlt GetDeviceCaps DeleteDC DeleteObject GetDIBits CreateDCW SelectObject

advapi32

InitiateSystemShutdownA QueryServiceStatusEx CloseServiceHandle StartServiceW ChangeServiceConfig2W CreateServiceW OpenServiceW OpenSCManagerW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryValueExW EnumServicesStatusExW QueryServiceConfigW QueryServiceConfig2W ControlService ChangeServiceConfigW OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameW LookupAccountSidW GetLengthSid CheckTokenMembership DuplicateTokenEx SetTokenInformation CreateProcessAsUserW RegEnumValueA ImpersonateLoggedOnUser RegOpenCurrentUser RegOverridePredefKey RevertToSelf RegEnumValueW DeleteService

shell32

SHFileOperationW CommandLineToArgvW ExtractIconExW

ole32

CoSetProxyBlanket CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantClear

odbc32

ord136 ord43 ord13 ord127 ord18 ord61 ord111 ord9 ord141 ord75 ord24 ord171 ord31 ord157 ord2

wtsapi32

WTSEnumerateProcessesW WTSFreeMemory WTSQuerySessionInformationW WTSUnRegisterSessionNotification WTSRegisterSessionNotification

ws2_32

WSASocketA WSAIoctl setsockopt closesocket WSARecvFrom bind WSASendTo WSACleanup WSAGetLastError WSAStartup getsockname