plugx | 45c944889a482ae2e0e0a8e260c3be737cb612c8804164badef61e8a8713b92f

General

Target

RasTls.exe
Size

105KB
MD5

62944e26b36b1dcace429ae26ba66164
SHA1

2616da1697f7c764ee7fb558887a6a3279861fac
SHA256

f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68
SHA512

e3c366044ac0b4df834b2f05d900cad01bc55b39028984ed3486aa2522e8c226bf9a81952da2c7e4bf0bc2c322d10fe58329e787238bb710a137827927b48d7c
SSDEEP

1536:To0lZUH+MeI1M04n45PFmsMfgiqf5YXneJ07soW8VD5cN:TOw4jYgiqf5yh7sl8VF

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects Talisman variant of PlugX 5 IoCs

Processes:

resource	yara_rule
behavioral6/memory/5076-136-0x0000000002260000-0x0000000002299000-memory.dmp	family_plugx_talisman
behavioral6/memory/4448-144-0x0000000000DE0000-0x0000000000E19000-memory.dmp	family_plugx_talisman
behavioral6/memory/4156-145-0x00000000009C0000-0x00000000009F9000-memory.dmp	family_plugx_talisman
behavioral6/memory/4448-146-0x0000000000DE0000-0x0000000000E19000-memory.dmp	family_plugx_talisman
behavioral6/memory/4156-147-0x00000000009C0000-0x00000000009F9000-memory.dmp	family_plugx_talisman

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 1 IoCs

Processes:

RasTls.exe

pid process

4448 RasTls.exe
Loads dropped DLL 1 IoCs

Processes:

RasTls.exe

pid process

4448 RasTls.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4828 schtasks.exe

pid	process
4448	RasTls.exe

pid	process
4448	RasTls.exe

pid	process
4828	schtasks.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

nslookup.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	nslookup.exe

Modifies registry class 2 IoCs

Processes:

nslookup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	nslookup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 35004600450037003900360045003900360033003900340034004400310033000000	nslookup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

nslookup.exe

pid process

4156 nslookup.exe
4156 nslookup.exe
4156 nslookup.exe
4156 nslookup.exe

pid	process
4156	nslookup.exe
4156	nslookup.exe
4156	nslookup.exe
4156	nslookup.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RasTls.exeRasTls.exenslookup.exe

description	pid	process
Token: SeDebugPrivilege	5076	RasTls.exe
Token: SeTcbPrivilege	5076	RasTls.exe
Token: SeDebugPrivilege	4448	RasTls.exe
Token: SeTcbPrivilege	4448	RasTls.exe
Token: SeDebugPrivilege	4156	nslookup.exe
Token: SeTcbPrivilege	4156	nslookup.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

RasTls.execmd.execmd.exeRasTls.exe

description	pid	process	target process
PID 5076 wrote to memory of 788	5076	RasTls.exe	cmd.exe
PID 5076 wrote to memory of 788	5076	RasTls.exe	cmd.exe
PID 5076 wrote to memory of 788	5076	RasTls.exe	cmd.exe
PID 5076 wrote to memory of 4880	5076	RasTls.exe	cmd.exe
PID 5076 wrote to memory of 4880	5076	RasTls.exe	cmd.exe
PID 5076 wrote to memory of 4880	5076	RasTls.exe	cmd.exe
PID 788 wrote to memory of 3144	788	cmd.exe	schtasks.exe
PID 788 wrote to memory of 3144	788	cmd.exe	schtasks.exe
PID 788 wrote to memory of 3144	788	cmd.exe	schtasks.exe
PID 4880 wrote to memory of 4828	4880	cmd.exe	schtasks.exe
PID 4880 wrote to memory of 4828	4880	cmd.exe	schtasks.exe
PID 4880 wrote to memory of 4828	4880	cmd.exe	schtasks.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe
PID 4448 wrote to memory of 4156	4448	RasTls.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\RasTls.exe
"C:\Users\Admin\AppData\Local\Temp\RasTls.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076

\??\c:\windows\SysWOW64\cmd.exe
c:\windows\system32\cmd.exe /c c:\windows\system32\schtasks.exe /delete /tn "SymantecRasTls" /F
2⤵
- Suspicious use of WriteProcessMemory
PID:788

\??\c:\windows\SysWOW64\schtasks.exe
c:\windows\system32\schtasks.exe /delete /tn "SymantecRasTls" /F
3⤵
PID:3144

\??\c:\windows\SysWOW64\cmd.exe
c:\windows\system32\cmd.exe /c c:\windows\system32\schtasks.exe /create /sc minute /mo 2 /tn "SymantecRasTls" /tr "\"C:\ProgramData\SymantecRasTls\RasTls.exe\"" /ru "system"
2⤵
- Suspicious use of WriteProcessMemory
PID:4880

\??\c:\windows\SysWOW64\schtasks.exe
c:\windows\system32\schtasks.exe /create /sc minute /mo 2 /tn "SymantecRasTls" /tr "\"C:\ProgramData\SymantecRasTls\RasTls.exe\"" /ru "system"
3⤵
- Creates scheduled task(s)
PID:4828

C:\ProgramData\SymantecRasTls\RasTls.exe
C:\ProgramData\SymantecRasTls\RasTls.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448

C:\Windows\SysWOW64\nslookup.exe
C:\Windows\system32\nslookup.exe 201 0
2⤵
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SymantecRasTls\RasTls.dll
Filesize
3KB

MD5
d5915394a6916a00c426aa2827d97c0e

SHA1
50064d66c9b55b6f7d22051b81914d8366fe36c8

SHA256
6cd5079a69d9a68029e37f2680f44b7ba71c2b1eecf4894c2a8b293d5f768f10

SHA512
56aa607a5a1bf095b017fd23a1007795f4bdd3a5a5efe571f7c74b7a4e37fb88f3031c26b5189e9f67328222b3dda621a7379da5341bfa95e25605b703ea6373

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.dll
Filesize
3KB

MD5
d5915394a6916a00c426aa2827d97c0e

SHA1
50064d66c9b55b6f7d22051b81914d8366fe36c8

SHA256
6cd5079a69d9a68029e37f2680f44b7ba71c2b1eecf4894c2a8b293d5f768f10

SHA512
56aa607a5a1bf095b017fd23a1007795f4bdd3a5a5efe571f7c74b7a4e37fb88f3031c26b5189e9f67328222b3dda621a7379da5341bfa95e25605b703ea6373

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.dll.res
Filesize
136KB

MD5
9ae8a7837c60f3f587701934ff41bd96

SHA1
ea7595bff1cfd1d72fe72417bf263d9adc9bc59e

SHA256
37b3fb9aa12277f355bbb334c82b41e4155836cf3a1b83e543ce53da9d429e2f

SHA512
61ba5240b9a2376f8c88616b229323f71775639d1629467847260d555251b5d9b9e36a7858d8ff1601e3661163020219c2b3192997acd323bf58b27f8ed2efe2

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.exe
Filesize
105KB

MD5
62944e26b36b1dcace429ae26ba66164

SHA1
2616da1697f7c764ee7fb558887a6a3279861fac

SHA256
f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68

SHA512
e3c366044ac0b4df834b2f05d900cad01bc55b39028984ed3486aa2522e8c226bf9a81952da2c7e4bf0bc2c322d10fe58329e787238bb710a137827927b48d7c

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.exe
Filesize
105KB

MD5
62944e26b36b1dcace429ae26ba66164

SHA1
2616da1697f7c764ee7fb558887a6a3279861fac

SHA256
f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68

SHA512
e3c366044ac0b4df834b2f05d900cad01bc55b39028984ed3486aa2522e8c226bf9a81952da2c7e4bf0bc2c322d10fe58329e787238bb710a137827927b48d7c

Download Submit
memory/788-133-0x0000000000000000-mapping.dmp

Download
memory/3144-135-0x0000000000000000-mapping.dmp

Download
memory/4156-147-0x00000000009C0000-0x00000000009F9000-memory.dmp

Filesize
228KB

Download
memory/4156-145-0x00000000009C0000-0x00000000009F9000-memory.dmp

Filesize
228KB

Download
memory/4156-143-0x0000000000000000-mapping.dmp

Download
memory/4448-144-0x0000000000DE0000-0x0000000000E19000-memory.dmp

Filesize
228KB

Download
memory/4448-146-0x0000000000DE0000-0x0000000000E19000-memory.dmp

Filesize
228KB

Download
memory/4828-137-0x0000000000000000-mapping.dmp

Download
memory/4880-134-0x0000000000000000-mapping.dmp

Download
memory/5076-136-0x0000000002260000-0x0000000002299000-memory.dmp

Filesize
228KB

Download
memory/5076-132-0x0000000002190000-0x00000000021B3000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads