plugx | af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0

General

Target

af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe
Size

252KB
MD5

cddfa154bbe89d4627210eba087c3504
SHA1

eab98fc12e896f1e91960db2f7fb52c1b8767027
SHA256

af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0
SHA512

8623f541c2722ea84befc9bb1f001c5e970eb936f254c9e39538749a3f3b0176cd3083c829662052048238c981a976a7f7306691cce6ea752ee508136dc0903a
SSDEEP

6144:uQi0K39IDPPa9U9NrByDqXzVvdUE7HCzMCZf:3E9IDXa9erEMzVXTs

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2040-60-0x0000000001E10000-0x0000000001E3E000-memory.dmp	family_plugx
behavioral1/memory/592-61-0x00000000001E0000-0x000000000020E000-memory.dmp	family_plugx
behavioral1/memory/592-65-0x00000000001E0000-0x000000000020E000-memory.dmp	family_plugx
behavioral1/memory/328-67-0x0000000000250000-0x000000000027E000-memory.dmp	family_plugx
behavioral1/memory/328-68-0x0000000000250000-0x000000000027E000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 74.125.230.82
Destination IP 74.125.230.82

description	ioc
Destination IP	74.125.230.82
Destination IP	74.125.230.82

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 30003200390046003700460045003300370032003600320039003400440043000000	svchost.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\MJ	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exemsiexec.exe

pid	process
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
592	svchost.exe
592	svchost.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exesvchost.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe
Token: SeTcbPrivilege	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe
Token: SeDebugPrivilege	592	svchost.exe
Token: SeTcbPrivilege	592	svchost.exe
Token: SeDebugPrivilege	328	msiexec.exe
Token: SeTcbPrivilege	328	msiexec.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exesvchost.exe

description	pid	process	target process
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 2040 wrote to memory of 592	2040	af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe	svchost.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe
PID 592 wrote to memory of 328	592	svchost.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe
"C:\Users\Admin\AppData\Local\Temp\af5182946b0a6bc0b457a048c133d5b23fa4ab2411f7833f0c5513a5994fc5f0.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\SysWOW64\msiexec.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-64-0x0000000000000000-mapping.dmp

Download
memory/328-67-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/328-68-0x0000000000250000-0x000000000027E000-memory.dmp

Filesize
184KB

Download
memory/592-56-0x00000000000B0000-0x00000000000CB000-memory.dmp

Filesize
108KB

Download
memory/592-58-0x0000000000000000-mapping.dmp

Download
memory/592-61-0x00000000001E0000-0x000000000020E000-memory.dmp

Filesize
184KB

Download
memory/592-65-0x00000000001E0000-0x000000000020E000-memory.dmp

Filesize
184KB

Download
memory/2040-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

Filesize
8KB

Download
memory/2040-60-0x0000000001E10000-0x0000000001E3E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads