plugx | 1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f

General

Target

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
Size

148KB
MD5

f0be554b1d9b394bc2a90322ca944fce
SHA1

89bda0569dc5a83fa5e024fbe1e4338361e79719
SHA256

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f
SHA512

3da7baf6b4933c90c47376ec065097de1bc2be54b44d8558d3250d620d459c9a22d74b642b33caac62321217977a55e9381e615c8cb7c3d7a15c58ff9ca136d1
SSDEEP

3072:pZpnEqYRxCen7tHPr8LeThj71IgnCbHDSsYZVSXwQwdgeZ:zpn8TCuz8iThecCnSxZVSXFwdg

Score

10^/10

plugx persistence trojan

Malware Config

Signatures

Detects PlugX payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1228-57-0x0000000000310000-0x000000000033E000-memory.dmp	family_plugx
behavioral1/memory/2028-62-0x0000000000750000-0x000000000077E000-memory.dmp	family_plugx
behavioral1/memory/1228-64-0x0000000000310000-0x000000000033E000-memory.dmp	family_plugx
behavioral1/memory/2028-65-0x0000000000750000-0x000000000077E000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AppServerDis = "C:\\Windows\\AppServerDis.exe"	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

Drops file in Windows directory 2 IoCs

Processes:

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

description	ioc	process
File created	C:\Windows\AppServerDis.exe	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
File opened for modification	C:\Windows\AppServerDis.exe	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

Modifies registry class 2 IoCs

Processes:

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\MJ	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\MJ\CLSID = 38003500320030003200320033004600320046004500320034003800390036000000	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exemsiexec.exe

pid	process
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
2028	msiexec.exe
2028	msiexec.exe
1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
Token: SeTcbPrivilege	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
Token: SeDebugPrivilege	2028	msiexec.exe
Token: SeTcbPrivilege	2028	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

pid process

1228 1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe

description	pid	process	target process
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe
PID 1228 wrote to memory of 2028	1228	1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe
"C:\Users\Admin\AppData\Local\Temp\1acd0212ee970abfea717c2eac9a73613787f86dab42298f1d74a06f79554f0f.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228

C:\Windows\SysWOW64\msiexec.exe
C:\Windows\SysWOW64\msiexec.exe
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-55-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1228-56-0x0000000001D70000-0x0000000001E70000-memory.dmp

Filesize
1024KB

Download
memory/1228-57-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/1228-63-0x0000000001D70000-0x0000000001E70000-memory.dmp

Filesize
1024KB

Download
memory/1228-64-0x0000000000310000-0x000000000033E000-memory.dmp

Filesize
184KB

Download
memory/2028-58-0x0000000000130000-0x000000000014B000-memory.dmp

Filesize
108KB

Download
memory/2028-60-0x0000000000000000-mapping.dmp

Download
memory/2028-62-0x0000000000750000-0x000000000077E000-memory.dmp

Filesize
184KB

Download
memory/2028-65-0x0000000000750000-0x000000000077E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads