plugx | e2f383123254f5b4a91cc8ea7fbe6d2a44c779368777207736a02a125d5c477b

General

Target

AvastProxy.exe
Size

56KB
MD5

feac3e6946ab9b39c66a8756a4a7468f
SHA1

b490fbb91ebf327173940f3ed93f518191abb5e8
SHA256

560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23
SHA512

55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b
SSDEEP

768:alArI/PzmESYUawSgUhuGasKgFADGVih3:alccPz+cwSgUERsI

Score

10^/10

plugx persistence trojan

Malware Config

Extracted

Family

plugx

C2

www.systeminfor.com:80

www.systeminfor.com:53

www.systeminfor.com:25

Attributes

folder
AvastProxyETj

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 1 IoCs

Processes:

AvastProxy.exe

pid process

1168 AvastProxy.exe
Loads dropped DLL 3 IoCs

Processes:

AvastProxy.exeAvastProxy.exe

pid process

1044 AvastProxy.exe
1044 AvastProxy.exe
1168 AvastProxy.exe
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 58.158.177.102
Destination IP 58.158.177.102

pid	process
1168	AvastProxy.exe

pid	process
1044	AvastProxy.exe
1044	AvastProxy.exe
1168	AvastProxy.exe

description	ioc
Destination IP	58.158.177.102
Destination IP	58.158.177.102

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AvastProxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	AvastProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AvastProxyETj = "\"C:\\ProgramData\\AvastProxyETj\\AvastProxy.exe\" 655"	AvastProxy.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run	AvastProxy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvastProxyETj = "\"C:\\ProgramData\\AvastProxyETj\\AvastProxy.exe\" 655"	AvastProxy.exe

Modifies registry class 3 IoCs

Processes:

AvastProxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu\PROXY	AvastProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu	AvastProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\PROXY	AvastProxy.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

AvastProxy.exe

pid process

1168 AvastProxy.exe
1168 AvastProxy.exe
1168 AvastProxy.exe
1168 AvastProxy.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

AvastProxy.exe

description pid process

Token: SeDebugPrivilege 1168 AvastProxy.exe
Token: SeDebugPrivilege 1168 AvastProxy.exe
Token: SeTcbPrivilege 1168 AvastProxy.exe

pid	process
1168	AvastProxy.exe
1168	AvastProxy.exe
1168	AvastProxy.exe
1168	AvastProxy.exe

description	pid	process
Token: SeDebugPrivilege	1168	AvastProxy.exe
Token: SeDebugPrivilege	1168	AvastProxy.exe
Token: SeTcbPrivilege	1168	AvastProxy.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

AvastProxy.exe

description	pid	process	target process
PID 1044 wrote to memory of 1168	1044	AvastProxy.exe	AvastProxy.exe
PID 1044 wrote to memory of 1168	1044	AvastProxy.exe	AvastProxy.exe
PID 1044 wrote to memory of 1168	1044	AvastProxy.exe	AvastProxy.exe
PID 1044 wrote to memory of 1168	1044	AvastProxy.exe	AvastProxy.exe

C:\Users\Admin\AppData\Local\Temp\AvastProxy.exe
"C:\Users\Admin\AppData\Local\Temp\AvastProxy.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1044
- C:\ProgramData\AvastProxyETj\AvastProxy.exe
  C:\ProgramData\AvastProxyETj\AvastProxy.exe 655
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AvastProxyETj\AvastProxy.exe

Filesize
56KB

MD5
feac3e6946ab9b39c66a8756a4a7468f

SHA1
b490fbb91ebf327173940f3ed93f518191abb5e8

SHA256
560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23

SHA512
55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b

Download Submit
C:\ProgramData\AvastProxyETj\main.dat

Filesize
135KB

MD5
9d2d878846afd16a66305f14a369371a

SHA1
4fe096ccc897209e238fe7ba4458f7f0fd3d75e5

SHA256
c2652596fb983c2b4c9bd3daa97ad992650be070ce4a0d4fbbaba0eb4e43decc

SHA512
28dad3637b2d28b85624ec52e58e71c7585add68767589dfc14e8aaf96bb246e27cb56cc5d2801bae7e2262d1349e0a0ae931efe7d8c2320726f250df8c167f5

Download Submit
C:\ProgramData\AvastProxyETj\wsc.dll

Filesize
76KB

MD5
dc52696888f68d5b0e3d5e810c0d2a3c

SHA1
f72a97bf9ab09b3639c3c58c9c34d3675a507b87

SHA256
a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a

SHA512
22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2

Download Submit
\ProgramData\AvastProxyETj\AvastProxy.exe

Filesize
56KB

MD5
feac3e6946ab9b39c66a8756a4a7468f

SHA1
b490fbb91ebf327173940f3ed93f518191abb5e8

SHA256
560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23

SHA512
55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b

Download Submit
\ProgramData\AvastProxyETj\AvastProxy.exe

Filesize
56KB

MD5
feac3e6946ab9b39c66a8756a4a7468f

SHA1
b490fbb91ebf327173940f3ed93f518191abb5e8

SHA256
560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23

SHA512
55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b

Download Submit
\ProgramData\AvastProxyETj\wsc.dll

Filesize
76KB

MD5
dc52696888f68d5b0e3d5e810c0d2a3c

SHA1
f72a97bf9ab09b3639c3c58c9c34d3675a507b87

SHA256
a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a

SHA512
22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2

Download Submit
memory/1044-57-0x0000000000288000-0x00000000002AB000-memory.dmp

Filesize
140KB

Download
memory/1044-56-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download
memory/1044-62-0x0000000000288000-0x00000000002AB000-memory.dmp

Filesize
140KB

Download
memory/1044-55-0x00000000008F0000-0x0000000004521000-memory.dmp

Filesize
60.2MB

Download
memory/1044-54-0x0000000000288000-0x00000000002AB000-memory.dmp

Filesize
140KB

Download
memory/1168-60-0x0000000000000000-mapping.dmp

Download
memory/1168-66-0x00000000007B8000-0x00000000007DB000-memory.dmp

Filesize
140KB

Download
memory/1168-67-0x0000000000E80000-0x0000000004AB1000-memory.dmp

Filesize
60.2MB

Download
memory/1168-68-0x00000000007B8000-0x00000000007DB000-memory.dmp

Filesize
140KB

Download
memory/1168-70-0x00000000007B8000-0x00000000007DB000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads