Analysis
-
max time kernel
153s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 13:57
Static task
static1
Behavioral task
behavioral1
Sample
fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
General
-
Target
fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe
-
Size
256KB
-
MD5
f6caa0160a6f0e5264fd16fa5ae95696
-
SHA1
95c80857c55d62e7b641d5ce7320d4b005a6e532
-
SHA256
fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e
-
SHA512
687fcdc4800507b815cd468813f109c5a5fe374e3f42fb16a9e449bb1aa3eca5bd34869dc9eae6278dc9209dd04cb8b8dafb4ab8f1142436a4dd3b3c6877c07d
-
SSDEEP
6144:B34cqJNXGftA+N1hvNca5UBtpBQYdzMCZf:ty0K+NxOTBQYh
Malware Config
Signatures
-
Detects PlugX payload 5 IoCs
resource yara_rule behavioral2/memory/2264-133-0x0000000003D40000-0x0000000003E1B000-memory.dmp family_plugx behavioral2/memory/2264-134-0x0000000004EF0000-0x0000000004F1E000-memory.dmp family_plugx behavioral2/memory/4360-136-0x0000000001670000-0x000000000169E000-memory.dmp family_plugx behavioral2/memory/2264-138-0x0000000004EF0000-0x0000000004F1E000-memory.dmp family_plugx behavioral2/memory/4360-139-0x0000000001670000-0x000000000169E000-memory.dmp family_plugx -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 77.247.182.244 Destination IP 77.247.182.244 Destination IP 77.247.182.244 Destination IP 77.247.182.244 Destination IP 77.247.182.244 Destination IP 77.247.182.244 -
Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\LocalServer32 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\ProgID\ = "SoftHSM.Document" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\InprocHandler32 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\InprocHandler32\ = "ole32.dll" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document\CLSID\ = "{6CD83D94-AC11-4461-89D0-982E7363332B}" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FDB29B~1.EXE" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\Software\CLASSES\MJ fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 30004500370046004200310037003800360041004400390043004300380043000000 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document\ = "SoftHS Document" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SoftHSM.Document\CLSID fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B} fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\ = "SoftHS Document" fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6CD83D94-AC11-4461-89D0-982E7363332B}\ProgID fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe 4360 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4360 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Token: SeTcbPrivilege 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe Token: SeDebugPrivilege 4360 msiexec.exe Token: SeTcbPrivilege 4360 msiexec.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79 PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79 PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79 PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79 PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79 PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79 PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79 PID 2264 wrote to memory of 4360 2264 fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe"C:\Users\Admin\AppData\Local\Temp\fdb29bbc9b3257038bbb10f10140f5137e67cab3d38cf4afb60ffae54b60ab2e.exe"1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4360
-