plugx | 21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06-11-2022 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe
Size

227KB
MD5

14df7bc4d0778cd7b039ef890d5f0150
SHA1

07172e6e7f513163349ddfe19e5e3e77b4253316
SHA256

21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d
SHA512

54834e1de1758d097c39e777cfb9faad5dcc99f94accbbd626b3f4cba91265e8857e151d060d4cbf1c46d6decfd79b73a766ec9a7eeb6b9b5fe6d05aa7bdd216
SSDEEP

3072:QLnJE0ewnIvRzP1+ttt4Xiibl26wAXvR5g9QC8Qvqwe+P1MAPA8cquwJth/gRp:QLnvip83y27Apa9588jP1lI8HuwHh

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1912-73-0x00000000002C0000-0x00000000002EE000-memory.dmp	family_plugx
behavioral1/memory/1224-75-0x00000000003B0000-0x00000000003DE000-memory.dmp	family_plugx
behavioral1/memory/860-76-0x0000000000170000-0x000000000019E000-memory.dmp	family_plugx
behavioral1/memory/1520-82-0x0000000000590000-0x00000000005BE000-memory.dmp	family_plugx
behavioral1/memory/860-83-0x0000000000170000-0x000000000019E000-memory.dmp	family_plugx
behavioral1/memory/1520-84-0x0000000000590000-0x00000000005BE000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 2 IoCs

Processes:

SOUNDMAN.exeSOUNDMAN.exe

pid process

1224 SOUNDMAN.exe
1912 SOUNDMAN.exe
Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

860 svchost.exe

pid	process
1224	SOUNDMAN.exe
1912	SOUNDMAN.exe

Loads dropped DLL 4 IoCs

Processes:

21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exeSOUNDMAN.exeSOUNDMAN.exe

pid	process
1416	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe
1416	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe
1224	SOUNDMAN.exe
1912	SOUNDMAN.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\MJ	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 33003200390041003200350044003900340045004200420035003000390039000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exemsiexec.exe

pid	process
860	svchost.exe
860	svchost.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe
860	svchost.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
1520	msiexec.exe
860	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

SOUNDMAN.exeSOUNDMAN.exesvchost.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1224	SOUNDMAN.exe
Token: SeTcbPrivilege	1224	SOUNDMAN.exe
Token: SeDebugPrivilege	1912	SOUNDMAN.exe
Token: SeTcbPrivilege	1912	SOUNDMAN.exe
Token: SeDebugPrivilege	860	svchost.exe
Token: SeTcbPrivilege	860	svchost.exe
Token: SeDebugPrivilege	1520	msiexec.exe
Token: SeTcbPrivilege	1520	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exeSOUNDMAN.exesvchost.exe

description	pid	process	target process
PID 1416 wrote to memory of 1224	1416	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe	SOUNDMAN.exe
PID 1416 wrote to memory of 1224	1416	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe	SOUNDMAN.exe
PID 1416 wrote to memory of 1224	1416	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe	SOUNDMAN.exe
PID 1416 wrote to memory of 1224	1416	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe	SOUNDMAN.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 1912 wrote to memory of 860	1912	SOUNDMAN.exe	svchost.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe
PID 860 wrote to memory of 1520	860	svchost.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe
"C:\Users\Admin\AppData\Local\Temp\21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416

C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
"C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe" 100 1416
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1224

C:\ProgramData\SxS\SOUNDMAN.exe
C:\ProgramData\SxS\SOUNDMAN.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Deletes itself
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:860

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\SysWOW64\msiexec.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\HID.DLL
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
C:\ProgramData\SxS\HID.DLLx
Filesize
116KB

MD5
ad48932d387032a6023024a70eccf72e

SHA1
ef84b460965215e0b945a8e467134e5ee5047dbb

SHA256
53b8914adb4613700923d6a8a9f2b30e2b7218e4e980804e40d4052e3232e4cb

SHA512
f96c61d16319396dd69ba45e36ccb6445b40f8c2e1c5676fe152fce3051fd0fa0542b730a04073c11696135233625a40bfad1d90e329dd738f6df83df2d90c87

Download Submit
C:\ProgramData\SxS\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
C:\ProgramData\SxS\bug.log
Filesize
456B

MD5
2d86a9706dc16a62663976e7be1ef901

SHA1
ff0a3fb632762d9cfd017d8c1f0278721c60c89c

SHA256
40a4f4f95cb01caa82ddc7f8d3fc26babe59b353c682ef7354bcf573def91dff

SHA512
f3064a0645e594491a9770c72a0e884f6bfdc1c6af50db4e2bbd1bce975b210ff0ddbb65619ef74b1c4430833f8d54a808cc3bd11215e9f5126719d82fcca581

Download Submit
C:\ProgramData\SxS\bug.log
Filesize
618B

MD5
c562a68521ae33feb49f28f030ae8c0f

SHA1
5ec62c2e51512a4872188a6223682f83476330d0

SHA256
f66e23fb1597ed6ba3123aca57cf08c364226deab59a84d487ede3d92877229c

SHA512
91b1d3184515ead438b966e2c72a477fdfcd2bf0df9e6ec6301876d1b8773a0cd8c635c70a843a8cbee6973d93d835e6fdda41c1cb406aee429b7ff33e259879

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\HID.DLL
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\HID.DLLx
Filesize
116KB

MD5
ad48932d387032a6023024a70eccf72e

SHA1
ef84b460965215e0b945a8e467134e5ee5047dbb

SHA256
53b8914adb4613700923d6a8a9f2b30e2b7218e4e980804e40d4052e3232e4cb

SHA512
f96c61d16319396dd69ba45e36ccb6445b40f8c2e1c5676fe152fce3051fd0fa0542b730a04073c11696135233625a40bfad1d90e329dd738f6df83df2d90c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
\ProgramData\SxS\HID.dll
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
\Users\Admin\AppData\Local\Temp\HID\hid.dll
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
memory/860-68-0x00000000000A0000-0x00000000000BB000-memory.dmp

Filesize
108KB

Download
memory/860-70-0x0000000000000000-mapping.dmp

Download
memory/860-76-0x0000000000170000-0x000000000019E000-memory.dmp

Filesize
184KB

Download
memory/860-83-0x0000000000170000-0x000000000019E000-memory.dmp

Filesize
184KB

Download
memory/1224-58-0x0000000074DC1000-0x0000000074DC3000-memory.dmp

Filesize
8KB

Download
memory/1224-75-0x00000000003B0000-0x00000000003DE000-memory.dmp

Filesize
184KB

Download
memory/1224-56-0x0000000000000000-mapping.dmp

Download
memory/1520-80-0x0000000000000000-mapping.dmp

Download
memory/1520-82-0x0000000000590000-0x00000000005BE000-memory.dmp

Filesize
184KB

Download
memory/1520-84-0x0000000000590000-0x00000000005BE000-memory.dmp

Filesize
184KB

Download
memory/1912-72-0x0000000001DB0000-0x0000000001EB0000-memory.dmp

Filesize
1024KB

Download
memory/1912-73-0x00000000002C0000-0x00000000002EE000-memory.dmp

Filesize
184KB

Download