plugx | e2f383123254f5b4a91cc8ea7fbe6d2a44c779368777207736a02a125d5c477b

General

Target

AvastProxy.exe
Size

56KB
MD5

feac3e6946ab9b39c66a8756a4a7468f
SHA1

b490fbb91ebf327173940f3ed93f518191abb5e8
SHA256

560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23
SHA512

55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b
SSDEEP

768:alArI/PzmESYUawSgUhuGasKgFADGVih3:alccPz+cwSgUERsI

Score

10^/10

plugx persistence trojan

Malware Config

Extracted

Family

plugx

C2

www.systeminfor.com:80

www.systeminfor.com:53

www.systeminfor.com:25

Attributes

folder
AvastProxyETj

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 1 IoCs

Processes:

AvastProxy.exe

pid process

4064 AvastProxy.exe
Loads dropped DLL 1 IoCs

Processes:

AvastProxy.exe

pid process

4064 AvastProxy.exe
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 58.158.177.102
Destination IP 58.158.177.102
Destination IP 58.158.177.102

description	ioc
Destination IP	58.158.177.102
Destination IP	58.158.177.102
Destination IP	58.158.177.102

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AvastProxy.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	AvastProxy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastProxyETj = "\"C:\\ProgramData\\AvastProxyETj\\AvastProxy.exe\" 953"	AvastProxy.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	AvastProxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\AvastProxyETj = "\"C:\\ProgramData\\AvastProxyETj\\AvastProxy.exe\" 953"	AvastProxy.exe

Modifies registry class 3 IoCs

Processes:

AvastProxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu	AvastProxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\PROXY	AvastProxy.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu\PROXY	AvastProxy.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

AvastProxy.exe

pid	process
4064	AvastProxy.exe
4064	AvastProxy.exe
4064	AvastProxy.exe
4064	AvastProxy.exe
4064	AvastProxy.exe
4064	AvastProxy.exe
4064	AvastProxy.exe
4064	AvastProxy.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

AvastProxy.exe

description pid process

Token: SeDebugPrivilege 4064 AvastProxy.exe
Token: SeDebugPrivilege 4064 AvastProxy.exe
Token: SeTcbPrivilege 4064 AvastProxy.exe

description	pid	process
Token: SeDebugPrivilege	4064	AvastProxy.exe
Token: SeDebugPrivilege	4064	AvastProxy.exe
Token: SeTcbPrivilege	4064	AvastProxy.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

AvastProxy.exe

description	pid	process	target process
PID 3068 wrote to memory of 4064	3068	AvastProxy.exe	AvastProxy.exe
PID 3068 wrote to memory of 4064	3068	AvastProxy.exe	AvastProxy.exe
PID 3068 wrote to memory of 4064	3068	AvastProxy.exe	AvastProxy.exe

C:\Users\Admin\AppData\Local\Temp\AvastProxy.exe
"C:\Users\Admin\AppData\Local\Temp\AvastProxy.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3068

C:\ProgramData\AvastProxyETj\AvastProxy.exe
C:\ProgramData\AvastProxyETj\AvastProxy.exe 953
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AvastProxyETj\AvastProxy.exe
Filesize
56KB

MD5
feac3e6946ab9b39c66a8756a4a7468f

SHA1
b490fbb91ebf327173940f3ed93f518191abb5e8

SHA256
560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23

SHA512
55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b

Download Submit
C:\ProgramData\AvastProxyETj\AvastProxy.exe
Filesize
56KB

MD5
feac3e6946ab9b39c66a8756a4a7468f

SHA1
b490fbb91ebf327173940f3ed93f518191abb5e8

SHA256
560055994a2290b3eb3f354afbf5ebcf4b8d78820f238eae70d76ece81b97c23

SHA512
55c3089d2744412e14032e66390d0ccb25fb995994baf77aee0bd315057543c39d13ee9344dab839ab041e4ca950e09c30a320f95cc8b0f1c69174d2e6562f3b

Download Submit
C:\ProgramData\AvastProxyETj\main.dat
Filesize
135KB

MD5
9d2d878846afd16a66305f14a369371a

SHA1
4fe096ccc897209e238fe7ba4458f7f0fd3d75e5

SHA256
c2652596fb983c2b4c9bd3daa97ad992650be070ce4a0d4fbbaba0eb4e43decc

SHA512
28dad3637b2d28b85624ec52e58e71c7585add68767589dfc14e8aaf96bb246e27cb56cc5d2801bae7e2262d1349e0a0ae931efe7d8c2320726f250df8c167f5

Download Submit
C:\ProgramData\AvastProxyETj\wsc.dll
Filesize
76KB

MD5
dc52696888f68d5b0e3d5e810c0d2a3c

SHA1
f72a97bf9ab09b3639c3c58c9c34d3675a507b87

SHA256
a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a

SHA512
22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2

Download Submit
C:\ProgramData\AvastProxyETj\wsc.dll
Filesize
76KB

MD5
dc52696888f68d5b0e3d5e810c0d2a3c

SHA1
f72a97bf9ab09b3639c3c58c9c34d3675a507b87

SHA256
a1640a83373a8ce9e80734418ee0b10d48d3d0d823883a519849b50710c9f46a

SHA512
22cbe643038002e2d9dec7ffed7ba445ee1288571b445a8156c8bc533815bd330098893792b43c5592a881675a089f0b0229a230672569c62fa1032bec5ffcb2

Download Submit
memory/3068-133-0x0000000000953000-0x0000000000976000-memory.dmp

Filesize
140KB

Download
memory/3068-132-0x0000000000A40000-0x0000000004671000-memory.dmp

Filesize
60.2MB

Download
memory/4064-134-0x0000000000000000-mapping.dmp

Download
memory/4064-140-0x00000000011D0000-0x00000000012D0000-memory.dmp

Filesize
1024KB

Download
memory/4064-141-0x00000000010E3000-0x0000000001106000-memory.dmp

Filesize
140KB

Download
memory/4064-142-0x00000000010E3000-0x0000000001106000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads