plugx | 2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49

Resubmissions

15/11/2022, 10:35

221115-mmn1esce3t 10

15/03/2021, 11:09

210315-zqyylb62la 8

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
15/11/2022, 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
Size

362KB
MD5

f1f48360f95e1b43e9fba0fec5a2afb8
SHA1

70ceb467db7b0161d22e4545479f747417b9705a
SHA256

2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49
SHA512

88d945c7a064882681670d9402fb8d07cd0653f5d6e7801d95b0a4a840be2a362ccb11baa6911b47538681705a76d633d8fad374a6f541dd3ed651f3b63ae3b8
SSDEEP

6144:iz+92mhAMJ/cPl3iis3CLBQU/FoX+R76Hyca7P8w/nD3BOrPOaYjRtGTxR3Zar:iK2mhAMJ/cPlEO7c8zcyLxODStGtR3ZC

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 6 IoCs

resource	yara_rule
behavioral1/memory/1676-76-0x0000000000280000-0x00000000002B1000-memory.dmp	family_plugx
behavioral1/memory/1284-78-0x0000000000310000-0x0000000000341000-memory.dmp	family_plugx
behavioral1/memory/1928-79-0x00000000001F0000-0x0000000000221000-memory.dmp	family_plugx
behavioral1/memory/1248-85-0x0000000000240000-0x0000000000271000-memory.dmp	family_plugx
behavioral1/memory/1928-86-0x00000000001F0000-0x0000000000221000-memory.dmp	family_plugx
behavioral1/memory/1248-87-0x0000000000240000-0x0000000000271000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Executes dropped EXE 2 IoCs

pid	Process
1284	mcvsmap.exe
1676	mcvsmap.exe

Deletes itself 1 IoCs

pid	Process
1928	svchost.exe

Loads dropped DLL 6 IoCs

pid	Process
1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
1284	mcvsmap.exe
1676	mcvsmap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 31003500320044003400420045003300460031004600410033004100320043000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1928	svchost.exe
1928	svchost.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe
1248	msiexec.exe
1248	msiexec.exe
1928	svchost.exe
1248	msiexec.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1284	mcvsmap.exe
Token: SeTcbPrivilege	1284	mcvsmap.exe
Token: SeDebugPrivilege	1676	mcvsmap.exe
Token: SeTcbPrivilege	1676	mcvsmap.exe
Token: SeDebugPrivilege	1928	svchost.exe
Token: SeTcbPrivilege	1928	svchost.exe
Token: SeDebugPrivilege	1248	msiexec.exe
Token: SeTcbPrivilege	1248	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 1284	1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	26
PID 1348 wrote to memory of 1284	1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	26
PID 1348 wrote to memory of 1284	1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	26
PID 1348 wrote to memory of 1284	1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	26
PID 1348 wrote to memory of 1284	1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	26
PID 1348 wrote to memory of 1284	1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	26
PID 1348 wrote to memory of 1284	1348	2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe	26
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1676 wrote to memory of 1928	1676	mcvsmap.exe	28
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29
PID 1928 wrote to memory of 1248	1928	svchost.exe	29

C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe
"C:\Users\Admin\AppData\Local\Temp\2bc5ce39dd9afe2157448d3f6d8cb9c549ed39543d159616e38480b9e6c11c49.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1284

C:\ProgramData\VirusMap\mcvsmap.exe
C:\ProgramData\VirusMap\mcvsmap.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Deletes itself
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 1928
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SxS\bug.log

Filesize
456B

MD5
412847d24d8194b1eb266ea59313d28b

SHA1
3d2b69dc7b6984d94b351f7545a2069de2174a3e

SHA256
b94a6c0ccf387416c3621747b29a15ad0dfabdf5537648b91136c6d7877e9047

SHA512
01666a04e3210ee346d4ca1b0acd1932b2f00776221a28abb5d4b58d8d0ff264ad5c68708210d8c3e9b4f0e4a924dd3d6399df374031748118c2936351431083

Download Submit
C:\ProgramData\SxS\bug.log

Filesize
618B

MD5
21bbac54a8af25d7f9d2fd100bcb0d23

SHA1
ab2b21495844a18fa70733c8b29d54dfa662eefd

SHA256
e253d5338acb593a6fc443125713da6a22e2426233e66f5cc8123fa87c1fc292

SHA512
18aa832ebdd07d3262e8a9f57e89fd1ffd0a7cef8e92b598a42d6317dc82c2d00c410b1d87634a53df27eebc2ea87e584f0d12a5d3428b46fa64d1b51cd6aa0e

Download Submit
C:\ProgramData\VirusMap\McUtil.dll

Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
C:\ProgramData\VirusMap\McUtil.dll.PPT

Filesize
121KB

MD5
545bb4365a9b7cdb6d22844ebeedda93

SHA1
a267f1183b4ff843d68a63264846abf78cc71d1f

SHA256
d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7

SHA512
b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16

Download Submit
C:\ProgramData\VirusMap\mcvsmap.exe

Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll

Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.dll.PPT

Filesize
121KB

MD5
545bb4365a9b7cdb6d22844ebeedda93

SHA1
a267f1183b4ff843d68a63264846abf78cc71d1f

SHA256
d4fe890a08d4dd44b58a3b85b2a7e89536338099c1c42a9b7e85f4007b0a37b7

SHA512
b9c066f0166e8acbad1e822df8af6d69c7e23da33ff8b8bde9986222193e2be3d269866ec02a784e61d9cd160a8c5c299e04f9ab0981222521d4bb38f29b8e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe

Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe

Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\ProgramData\VirusMap\McUtil.DLL

Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\McUtil.DLL

Filesize
48KB

MD5
ad4a646b38a482cc07d5b09b4fffd3b3

SHA1
ae0f9bf2740d00c5d485827eb32aca33feaa3a90

SHA256
0a99238e1ebebc47d7a89b2ccddfae537479f7f77322b5d4941315d3f7e5ca48

SHA512
0a09420c939f71c26fabdc5a036e8e98413e6dbb70552a6b0a277abcf0cd1dcc8f2950631909bdddad97049d80312a4eeada6a1952dd51ebc9d5b38eb50866a1

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe

Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe

Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe

Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\mcvsmap.exe

Filesize
256KB

MD5
4e1e0b8b0673937415599bf2f24c44ad

SHA1
9224de3af2a246011c6294f64f27206d165317ba

SHA256
ae16e10e621d6610a3f7f2c7122f9d1263700ba02d1b90e42798decb2fe84096

SHA512
87f4407045f2213ecc76fb73e6b717ffc503e0c042be118965a139e7178fdcc2ff02fe0904cde3102679c4a74d09224e24f64dbd9faa609e06a6ce2fcda0ab5d

Download Submit
memory/1248-87-0x0000000000240000-0x0000000000271000-memory.dmp

Filesize
196KB

Download
memory/1248-85-0x0000000000240000-0x0000000000271000-memory.dmp

Filesize
196KB

Download
memory/1284-78-0x0000000000310000-0x0000000000341000-memory.dmp

Filesize
196KB

Download
memory/1348-54-0x0000000074F41000-0x0000000074F43000-memory.dmp

Filesize
8KB

Download
memory/1676-76-0x0000000000280000-0x00000000002B1000-memory.dmp

Filesize
196KB

Download
memory/1676-75-0x0000000001CA0000-0x0000000001DA0000-memory.dmp

Filesize
1024KB

Download
memory/1928-79-0x00000000001F0000-0x0000000000221000-memory.dmp

Filesize
196KB

Download
memory/1928-71-0x00000000000A0000-0x00000000000BD000-memory.dmp

Filesize
116KB

Download
memory/1928-86-0x00000000001F0000-0x0000000000221000-memory.dmp

Filesize
196KB

Download