plugx | 721ff308a706259c674adbd7c1606f5d5636674dc372ab739f1224e0be06184a

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
15-02-2023 14:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

t/Smadav.exe
Size

77KB
MD5

b830cd1b49bd31bcdb6192c20cf0b141
SHA1

b9629fdd735956772e9a3ceedcdb829bba6f8a43
SHA256

21d34a02ec28e9bd6f7b2f96ac7921f5ef08d291416b38a3fc8cf651f11fc820
SHA512

0ffef5b2681e57d3586b878bbf174a667423cd30e75a7f4ef60910922b2f9e3e02af309a7c3f15b70a42b747445513df43ce651dcb85bec7b94bfed6a7704ccd
SSDEEP

1536:NF81hiRzGLSNegJYJoUP8MXTi9Xtr835XoR66E:NFsGGLalYJoDDx835XoRe

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects PlugX payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4308-180-0x0000000000EB0000-0x0000000001EB0000-memory.dmp	family_plugx
behavioral2/memory/2508-141-0x00000000021E0000-0x00000000031E0000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 1 IoCs

Processes:

Smadav.exe

pid process

4308 Smadav.exe
Loads dropped DLL 1 IoCs

Processes:

Smadav.exe

pid process

4308 Smadav.exe

pid	process
4308	Smadav.exe

pid	process
4308	Smadav.exe

Drops file in System32 directory 5 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe

Drops file in Program Files directory 7 IoCs

Processes:

Smadav.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Smadavs	Smadav.exe
File opened for modification	C:\Program Files (x86)\Smadavs\SmadHook32.dll	Smadav.exe
File created	C:\Program Files (x86)\Smadavs\SmadHook32.dll	Smadav.exe
File opened for modification	C:\Program Files (x86)\Smadavs\Smadav.dat	Smadav.exe
File created	C:\Program Files (x86)\Smadavs\Smadav.dat	Smadav.exe
File opened for modification	C:\Program Files (x86)\Smadavs\Smadav.exe	Smadav.exe
File created	C:\Program Files (x86)\Smadavs\Smadav.exe	Smadav.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\KET.FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\KET.FAST\CLSID = 43003500370037004300460036004300360042004200430033003100460044000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exeuserinit.exe

pid	process
5032	svchost.exe
5032	svchost.exe
5032	svchost.exe
5032	svchost.exe
5032	svchost.exe
5032	svchost.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
5032	svchost.exe
5032	svchost.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
5032	svchost.exe
5032	svchost.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
5032	svchost.exe
5032	svchost.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
5032	svchost.exe
5032	svchost.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe
3504	userinit.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exeuserinit.exe

pid process

5032 svchost.exe
3504 userinit.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Smadav.exeSmadav.exesvchost.exeuserinit.exe

description	pid	process
Token: SeDebugPrivilege	2508	Smadav.exe
Token: SeTcbPrivilege	2508	Smadav.exe
Token: SeDebugPrivilege	4308	Smadav.exe
Token: SeTcbPrivilege	4308	Smadav.exe
Token: SeDebugPrivilege	5032	svchost.exe
Token: SeTcbPrivilege	5032	svchost.exe
Token: SeDebugPrivilege	3504	userinit.exe
Token: SeTcbPrivilege	3504	userinit.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Smadav.exesvchost.exe

description	pid	process	target process
PID 4308 wrote to memory of 5032	4308	Smadav.exe	svchost.exe
PID 4308 wrote to memory of 5032	4308	Smadav.exe	svchost.exe
PID 4308 wrote to memory of 5032	4308	Smadav.exe	svchost.exe
PID 4308 wrote to memory of 5032	4308	Smadav.exe	svchost.exe
PID 4308 wrote to memory of 5032	4308	Smadav.exe	svchost.exe
PID 4308 wrote to memory of 5032	4308	Smadav.exe	svchost.exe
PID 4308 wrote to memory of 5032	4308	Smadav.exe	svchost.exe
PID 5032 wrote to memory of 3504	5032	svchost.exe	userinit.exe
PID 5032 wrote to memory of 3504	5032	svchost.exe	userinit.exe
PID 5032 wrote to memory of 3504	5032	svchost.exe	userinit.exe
PID 5032 wrote to memory of 3504	5032	svchost.exe	userinit.exe
PID 5032 wrote to memory of 3504	5032	svchost.exe	userinit.exe
PID 5032 wrote to memory of 3504	5032	svchost.exe	userinit.exe
PID 5032 wrote to memory of 3504	5032	svchost.exe	userinit.exe

C:\Users\Admin\AppData\Local\Temp\t\Smadav.exe
"C:\Users\Admin\AppData\Local\Temp\t\Smadav.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2508

C:\Program Files (x86)\Smadavs\Smadav.exe
"C:\Program Files (x86)\Smadavs\Smadav.exe" 600 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 601 0
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Windows\SysWOW64\userinit.exe
    C:\Windows\system32\userinit.exe 609 5032
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3504

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Smadavs\SmadHook32.dll

Filesize
70KB

MD5
e1ed9b48016d43398cdf62a61c9b113d

SHA1
b8e7183fba57ca867393ea4edf62fe60d1549c94

SHA256
2e0b20fd34c70ec0566cb6e0852520fbab9452e3cb7aad8299ae841ac71733cf

SHA512
4b5fd58c0d6a59d710d80f0bec216ba19d9e52c1516d799a991995bd7a9f6e45667f924ef7b7320773881d521a1059bb8a2686e1324ed8083c10ca68e1f48714

Download Submit
C:\Program Files (x86)\Smadavs\Smadav.dat

Filesize
153KB

MD5
98f963bae9fd59ab4d50d9e275471ec6

SHA1
95c7b1eda105bf690cce854b53b9a308f82fc525

SHA256
a59724904c4bf6bfbf182e0235ede0109b65649b5d9f95acdb627610820eba37

SHA512
da3311197834a90cebc3d25dd1056717ca7c7d68e30328280b091fdfa2a41598fd3f09854a15c5d0cec939f21b044bab96c8ea28ba53e6c280c945fb31c892ab

Download Submit
C:\Program Files (x86)\Smadavs\Smadav.exe

Filesize
77KB

MD5
b830cd1b49bd31bcdb6192c20cf0b141

SHA1
b9629fdd735956772e9a3ceedcdb829bba6f8a43

SHA256
21d34a02ec28e9bd6f7b2f96ac7921f5ef08d291416b38a3fc8cf651f11fc820

SHA512
0ffef5b2681e57d3586b878bbf174a667423cd30e75a7f4ef60910922b2f9e3e02af309a7c3f15b70a42b747445513df43ce651dcb85bec7b94bfed6a7704ccd

Download Submit
C:\Program Files (x86)\Smadavs\Smadav.exe

Filesize
77KB

MD5
b830cd1b49bd31bcdb6192c20cf0b141

SHA1
b9629fdd735956772e9a3ceedcdb829bba6f8a43

SHA256
21d34a02ec28e9bd6f7b2f96ac7921f5ef08d291416b38a3fc8cf651f11fc820

SHA512
0ffef5b2681e57d3586b878bbf174a667423cd30e75a7f4ef60910922b2f9e3e02af309a7c3f15b70a42b747445513df43ce651dcb85bec7b94bfed6a7704ccd

Download Submit
\Program Files (x86)\Smadavs\SmadHook32.dll

Filesize
70KB

MD5
e1ed9b48016d43398cdf62a61c9b113d

SHA1
b8e7183fba57ca867393ea4edf62fe60d1549c94

SHA256
2e0b20fd34c70ec0566cb6e0852520fbab9452e3cb7aad8299ae841ac71733cf

SHA512
4b5fd58c0d6a59d710d80f0bec216ba19d9e52c1516d799a991995bd7a9f6e45667f924ef7b7320773881d521a1059bb8a2686e1324ed8083c10ca68e1f48714

Download Submit
memory/2508-148-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-129-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-118-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-119-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-120-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-121-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-122-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-150-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-124-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-125-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-126-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-127-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-128-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-141-0x00000000021E0000-0x00000000031E0000-memory.dmp

Filesize
16.0MB

Download
memory/2508-130-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-131-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-132-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-149-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-134-0x0000000000570000-0x0000000000597000-memory.dmp

Filesize
156KB

Download
memory/2508-135-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-136-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-138-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-137-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-139-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-140-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-142-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-143-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-144-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-145-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-146-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-147-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-116-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-123-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-117-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-133-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/2508-115-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/3504-233-0x0000000000000000-mapping.dmp

Download
memory/4308-152-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-164-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-175-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-166-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-176-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-174-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-177-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-179-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-178-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-181-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-184-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-183-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-172-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-157-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-182-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-162-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-173-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-171-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-169-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-165-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-163-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-161-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-158-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-156-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-154-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-155-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-153-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/4308-180-0x0000000000EB0000-0x0000000001EB0000-memory.dmp

Filesize
16.0MB

Download
memory/4308-160-0x0000000077E00000-0x0000000077F8E000-memory.dmp

Filesize
1.6MB

Download
memory/5032-190-0x0000000000000000-mapping.dmp

Download