plugx | 21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d

Analysis

max time kernel
156s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-11-2022 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe
Size

227KB
MD5

14df7bc4d0778cd7b039ef890d5f0150
SHA1

07172e6e7f513163349ddfe19e5e3e77b4253316
SHA256

21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d
SHA512

54834e1de1758d097c39e777cfb9faad5dcc99f94accbbd626b3f4cba91265e8857e151d060d4cbf1c46d6decfd79b73a766ec9a7eeb6b9b5fe6d05aa7bdd216
SSDEEP

3072:QLnJE0ewnIvRzP1+ttt4Xiibl26wAXvR5g9QC8Qvqwe+P1MAPA8cquwJth/gRp:QLnvip83y27Apa9588jP1lI8HuwHh

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4180-139-0x00000000021B0000-0x00000000021DE000-memory.dmp	family_plugx
behavioral2/memory/4584-146-0x0000000000E30000-0x0000000000E5E000-memory.dmp	family_plugx
behavioral2/memory/4180-149-0x00000000021B0000-0x00000000021DE000-memory.dmp	family_plugx
behavioral2/memory/4628-150-0x0000000001520000-0x000000000154E000-memory.dmp	family_plugx
behavioral2/memory/1676-152-0x00000000027C0000-0x00000000027EE000-memory.dmp	family_plugx
behavioral2/memory/4628-153-0x0000000001520000-0x000000000154E000-memory.dmp	family_plugx
behavioral2/memory/1676-154-0x00000000027C0000-0x00000000027EE000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 2 IoCs

Processes:

SOUNDMAN.exeSOUNDMAN.exe

pid process

4180 SOUNDMAN.exe
4584 SOUNDMAN.exe
Loads dropped DLL 2 IoCs

Processes:

SOUNDMAN.exeSOUNDMAN.exe

pid process

4180 SOUNDMAN.exe
4584 SOUNDMAN.exe

pid	process
4180	SOUNDMAN.exe
4584	SOUNDMAN.exe

pid	process
4180	SOUNDMAN.exe
4584	SOUNDMAN.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\MJ	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 31004300320042003000460039003500360036004200370046003900350041000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exemsiexec.exe

pid	process
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
4628	svchost.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
4628	svchost.exe
4628	svchost.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
4628	svchost.exe
4628	svchost.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
4628	svchost.exe
4628	svchost.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
4628	svchost.exe
4628	svchost.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe
1676	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exemsiexec.exe

pid process

4628 svchost.exe
1676 msiexec.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

SOUNDMAN.exeSOUNDMAN.exesvchost.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	4180	SOUNDMAN.exe
Token: SeTcbPrivilege	4180	SOUNDMAN.exe
Token: SeDebugPrivilege	4584	SOUNDMAN.exe
Token: SeTcbPrivilege	4584	SOUNDMAN.exe
Token: SeDebugPrivilege	4628	svchost.exe
Token: SeTcbPrivilege	4628	svchost.exe
Token: SeDebugPrivilege	1676	msiexec.exe
Token: SeTcbPrivilege	1676	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exeSOUNDMAN.exesvchost.exe

description	pid	process	target process
PID 2204 wrote to memory of 4180	2204	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe	SOUNDMAN.exe
PID 2204 wrote to memory of 4180	2204	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe	SOUNDMAN.exe
PID 2204 wrote to memory of 4180	2204	21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe	SOUNDMAN.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4584 wrote to memory of 4628	4584	SOUNDMAN.exe	svchost.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe
PID 4628 wrote to memory of 1676	4628	svchost.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe
"C:\Users\Admin\AppData\Local\Temp\21cb6abb7e688a3bd2dc7e0313d17fd095c4314639c489040a3b164784d59f6d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
"C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe" 100 2204
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4180

C:\ProgramData\SxS\SOUNDMAN.exe
C:\ProgramData\SxS\SOUNDMAN.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\SysWOW64\msiexec.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\HID.DLL
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
C:\ProgramData\SxS\HID.DLLx
Filesize
116KB

MD5
ad48932d387032a6023024a70eccf72e

SHA1
ef84b460965215e0b945a8e467134e5ee5047dbb

SHA256
53b8914adb4613700923d6a8a9f2b30e2b7218e4e980804e40d4052e3232e4cb

SHA512
f96c61d16319396dd69ba45e36ccb6445b40f8c2e1c5676fe152fce3051fd0fa0542b730a04073c11696135233625a40bfad1d90e329dd738f6df83df2d90c87

Download Submit
C:\ProgramData\SxS\HID.dll
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
C:\ProgramData\SxS\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
C:\ProgramData\SxS\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
C:\ProgramData\SxS\bug.log
Filesize
456B

MD5
ac642e1f73e93594c26a8b1dee2eff3b

SHA1
95d56e6e457d3bbe2a85f7dd7bb93a65a53e2538

SHA256
8e4de671332d097a735568c7c93c1a8ac9c5fc9b90b920256f7a758bb187d621

SHA512
496bb64e062d7182446e67312c5dd7027a8e299c58e2e14530f0260ed75c6bf0fee9401636456b46abbaec63c66e54eeed7f2993564a4f46c87caaa587d7b4c4

Download Submit
C:\ProgramData\SxS\bug.log
Filesize
618B

MD5
9925524a0b1ac4b7155452079709f26a

SHA1
fe724900da9ff392a89c7664412da066bf578470

SHA256
abab98e30018b78af41cbf4f7902f76e32b0bdc49619511f319be72c340c2aa3

SHA512
9e1c8f7da4e76b4adf365e7017ad3d473b98926656d0ea2f618f9bd6edab7fbddf752dfe786419546248b167fa26bb281c44a037994862fc64621d2792f2101c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\HID.DLL
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\HID.DLLx
Filesize
116KB

MD5
ad48932d387032a6023024a70eccf72e

SHA1
ef84b460965215e0b945a8e467134e5ee5047dbb

SHA256
53b8914adb4613700923d6a8a9f2b30e2b7218e4e980804e40d4052e3232e4cb

SHA512
f96c61d16319396dd69ba45e36ccb6445b40f8c2e1c5676fe152fce3051fd0fa0542b730a04073c11696135233625a40bfad1d90e329dd738f6df83df2d90c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\SOUNDMAN.exe
Filesize
82KB

MD5
798c0c1ff4e0fce646ca82ae0379ccb0

SHA1
3f65f997f350a59ac67e432092cf7f5cfe94a701

SHA256
54d08331f511823755cbbac3aad698bbcdfcde71f47b827dcfc6ada89e753d80

SHA512
be7924f6179d774d0e4f91a6f044abbb12e9cbf1e19a49e115da5a2eeedbe4c0b29879cf41008d27d13fdb80963d846527d53721d94668719d1331bf1867de3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\HID\hid.dll
Filesize
41KB

MD5
92942a8ca4f192d855b300d6ab04245a

SHA1
612be21471831a2ebd1a2959649a8ad29fa46112

SHA256
918567caf6bf3fa3a29067d5671c4bca1b340c405791b4c5f80994215bac8ca0

SHA512
055d4b62ccc0820943016de4a5bb4bb02c24deffaef7022da65e1d855680d513191722cdef64cc4a640c852d3475a92767a036bfb41347636a71e52fe9c64554

Download Submit
memory/1676-151-0x0000000000000000-mapping.dmp

Download
memory/1676-154-0x00000000027C0000-0x00000000027EE000-memory.dmp

Filesize
184KB

Download
memory/1676-152-0x00000000027C0000-0x00000000027EE000-memory.dmp

Filesize
184KB

Download
memory/4180-138-0x00000000021F0000-0x00000000022F0000-memory.dmp

Filesize
1024KB

Download
memory/4180-132-0x0000000000000000-mapping.dmp

Download
memory/4180-139-0x00000000021B0000-0x00000000021DE000-memory.dmp

Filesize
184KB

Download
memory/4180-149-0x00000000021B0000-0x00000000021DE000-memory.dmp

Filesize
184KB

Download
memory/4584-146-0x0000000000E30000-0x0000000000E5E000-memory.dmp

Filesize
184KB

Download
memory/4628-150-0x0000000001520000-0x000000000154E000-memory.dmp

Filesize
184KB

Download
memory/4628-153-0x0000000001520000-0x000000000154E000-memory.dmp

Filesize
184KB

Download
memory/4628-145-0x0000000000000000-mapping.dmp

Download