Analysis
-
max time kernel
185s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 13:57
Static task
static1
Behavioral task
behavioral1
Sample
fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe
-
Size
256KB
-
MD5
f6caa0160a6f0e5264fd16fa5ae95696
-
SHA1
95c80857c55d62e7b641d5ce7320d4b005a6e532
-
SHA256
fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e
-
SHA512
687fcdc4800507b815cd468813f109c5a5fe374e3f42fb16a9e449bb1aa3eca5bd34869dc9eae6278dc9209dd04cb8b8dafb4ab8f1142436a4dd3b3c6877c07d
-
SSDEEP
6144:B34cqJNXGftA+N1hvNca5UBtpBQYdzMCZf:ty0K+NxOTBQYh
Malware Config
Signatures
-
Detects PlugX payload 4 IoCs
resource yara_rule behavioral1/memory/1372-57-0x00000000026D0000-0x00000000026FE000-memory.dmp family_plugx behavioral1/memory/1680-62-0x0000000000270000-0x000000000029E000-memory.dmp family_plugx behavioral1/memory/1372-64-0x00000000026D0000-0x00000000026FE000-memory.dmp family_plugx behavioral1/memory/1680-65-0x0000000000270000-0x000000000029E000-memory.dmp family_plugx -
Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 77.247.182.244 Destination IP 77.247.182.244 Destination IP 77.247.182.244 Destination IP 77.247.182.244 -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\ProgID\ = "SoftHSM.Document" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\LocalServer32 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FDB29B~1.EXE" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\Software\CLASSES\MJ fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 38003400420030004500300045004100420045003500300030004300420038000000 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document\CLSID\ = "{6CD83D94-AC11-4461-89D0-982E7363332B}" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\ProgID fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\ = "SoftHS Document" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document\CLSID fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\InprocHandler32 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\InprocHandler32\ = "ole32.dll" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document\ = "SoftHS Document" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B} fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1680 msiexec.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Token: SeTcbPrivilege 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Token: SeDebugPrivilege 1680 msiexec.exe Token: SeTcbPrivilege 1680 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28 PID 1372 wrote to memory of 1680 1372 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe"C:\Users\Admin\AppData\Local\Temp\fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680
-