plugx | a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91

Resubmissions

26-07-2022 07:12

220726-h1ld8sehcq 10

24-02-2022 11:15

220224-nczjvachd8 8

02-08-2021 09:23

210802-dz94clans6 8

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
26-07-2022 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
Size

497KB
MD5

23595373d96bdbaf4a1361971aa96539
SHA1

020b0f179386a5ceee09e042ed7818ee42b2eba8
SHA256

a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91
SHA512

7e19addfec1ed3aa921f79c45a342e1ad5aa5db0483a2b9e54396335396e9c92545d8e49b4520ce562d1b786741bfceb940327acddbb020da87e93708bc5a783

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 4 IoCs

resource	yara_rule
behavioral1/memory/240-76-0x0000000000210000-0x0000000000245000-memory.dmp	family_plugx
behavioral1/memory/1348-81-0x0000000000360000-0x0000000000395000-memory.dmp	family_plugx
behavioral1/memory/240-83-0x0000000000210000-0x0000000000245000-memory.dmp	family_plugx
behavioral1/memory/1348-85-0x0000000000360000-0x0000000000395000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Executes dropped EXE 2 IoCs

pid	Process
1920	mcinsupd.exe
2032	mcinsupd.exe

Loads dropped DLL 6 IoCs

pid	Process
1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
1920	mcinsupd.exe
2032	mcinsupd.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe	mcinsupd.exe
File opened for modification	C:\Program Files (x86)\McAfee VirusScan	mcinsupd.exe
File opened for modification	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll	mcinsupd.exe
File created	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll	mcinsupd.exe
File opened for modification	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat	mcinsupd.exe
File created	C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat	mcinsupd.exe
File opened for modification	C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe	mcinsupd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\KET.FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 32004600350041003100340035003100360039003500390038003100380033000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
240	svchost.exe
240	svchost.exe
240	svchost.exe
240	svchost.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
1348	rundll32.exe
240	svchost.exe
1348	rundll32.exe
1348	rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	mcinsupd.exe
Token: SeTcbPrivilege	1920	mcinsupd.exe
Token: SeDebugPrivilege	2032	mcinsupd.exe
Token: SeTcbPrivilege	2032	mcinsupd.exe
Token: SeDebugPrivilege	240	svchost.exe
Token: SeTcbPrivilege	240	svchost.exe
Token: SeDebugPrivilege	1348	rundll32.exe
Token: SeTcbPrivilege	1348	rundll32.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 1920	1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	26
PID 1856 wrote to memory of 1920	1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	26
PID 1856 wrote to memory of 1920	1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	26
PID 1856 wrote to memory of 1920	1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	26
PID 1856 wrote to memory of 1920	1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	26
PID 1856 wrote to memory of 1920	1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	26
PID 1856 wrote to memory of 1920	1856	a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe	26
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 2032 wrote to memory of 240	2032	mcinsupd.exe	28
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29
PID 240 wrote to memory of 1348	240	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe
"C:\Users\Admin\AppData\Local\Temp\a9511cdaa96ed59de73a7a7c7dc375de204bee7a9511c5ee71bf013010324a91.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:1920

C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe
"C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe" 600 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 601 0
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe 609 240
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\McAfee VirusScan\mcinsupd.exe

Filesize
187KB

MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Program Files (x86)\McAfee VirusScan\mytilus3.dat

Filesize
122KB

MD5
87443239386f6bbc435fe0d8e92a0cec

SHA1
068a0a8a25cb8eacd249ffd9c853a70630c7a7ac

SHA256
170f6b0a434e0688e43c14596948afe2b5f09cb4a4a1910f8dd9f3ee3848964c

SHA512
67d13d7e3c5183ac09515ad4da254ff7dff946c192d072d69d48c1489f144749f9f4eb42a62fd99550e94e6b20b0911ac31416e331489b8e07cc6b5b5135dafb

Download Submit
C:\Program Files (x86)\McAfee VirusScan\mytilus3.dll

Filesize
20KB

MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

Filesize
187KB

MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

Filesize
187KB

MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dat

Filesize
122KB

MD5
87443239386f6bbc435fe0d8e92a0cec

SHA1
068a0a8a25cb8eacd249ffd9c853a70630c7a7ac

SHA256
170f6b0a434e0688e43c14596948afe2b5f09cb4a4a1910f8dd9f3ee3848964c

SHA512
67d13d7e3c5183ac09515ad4da254ff7dff946c192d072d69d48c1489f144749f9f4eb42a62fd99550e94e6b20b0911ac31416e331489b8e07cc6b5b5135dafb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll

Filesize
20KB

MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
\Program Files (x86)\McAfee VirusScan\mytilus3.dll

Filesize
20KB

MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

Filesize
187KB

MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

Filesize
187KB

MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

Filesize
187KB

MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcinsupd.exe

Filesize
187KB

MD5
53c1f090734129fbccc2693d6b4afa04

SHA1
a06110c5b8092581f7aab798eb96d1a0511cf419

SHA256
507d49186748dd83d808281743a17fca4b226883c410ec76eb305360cbc8c091

SHA512
59f264df8fca777056b02aebf5861350050868eb8443f9d7d6c9b26dd6fcd9f42f658885bff3187030b8bcaa3715bf7eed1890301fc50d548cf1dbb58a30636f

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mytilus3.dll

Filesize
20KB

MD5
a6a6f1b05462dbf5692780014aa0e7e3

SHA1
2667adad830a74af565bb781ecb25b43a2bdccb4

SHA256
7fb38699abb8793d63b7dede1eb0ff0d5ced87310321782eaf1bc102820d2c5f

SHA512
96467dc791060541810f5c22db3823151416172343f175e926b1fba61c979bd3c275792598ccca5d4d76ac1d14daad1a9e024ffc305fa5282bf7f6272f9792ea

Download Submit
memory/240-71-0x00000000000A0000-0x00000000000BD000-memory.dmp

Filesize
116KB

Download
memory/240-76-0x0000000000210000-0x0000000000245000-memory.dmp

Filesize
212KB

Download
memory/240-82-0x0000000000080000-0x0000000000082000-memory.dmp

Filesize
8KB

Download
memory/240-83-0x0000000000210000-0x0000000000245000-memory.dmp

Filesize
212KB

Download
memory/1348-84-0x0000000000090000-0x0000000000092000-memory.dmp

Filesize
8KB

Download
memory/1348-85-0x0000000000360000-0x0000000000395000-memory.dmp

Filesize
212KB

Download
memory/1348-81-0x0000000000360000-0x0000000000395000-memory.dmp

Filesize
212KB

Download
memory/1856-54-0x00000000761D1000-0x00000000761D3000-memory.dmp

Filesize
8KB

Download
memory/2032-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download