Overview

overview

10

Static

static

3

lxautold.exe

windows7-x64

10

lxautold.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2023 16:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    lxautold.exe

  • Size

    765KB

  • MD5

    f7c83410bdf578a6316d1ce543456dfa

  • SHA1

    2814ed6a65dec94029a1c1e97b1a69c49b116e34

  • SHA256

    145d6db252fa4247ad08d85d651bdd6e6ff9068305ce4af3b9dca684f1a1aa5b

  • SHA512

    fa9c00697cc121421f7fc682b9ce9c78cf9efcec00c6bdc8a8df002462b97319f0bac20c2fa717ceb5985da20b4088232b7f5408192e5031adb0e60047bb5a80

  • SSDEEP

    12288:7h1Lk70TnvjcRydunMK6PdWmpDCLtdLQF6mghdjxjgEg+gCSrjrDQLXoF0MfF16f:Hk70TrcRxMrdWmpDYOFspxjbg+arQL6S

Score
10/10
ploutusatmbackdoor

Malware Config

Signatures

  • Detected Ploutus loader 34 IoCs
  • Ploutus

    Ploutus is an ATM malware written in C#.

    backdooratmploutus
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\lxautold.exe
    "C:\Users\Admin\AppData\Local\Temp\lxautold.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4024
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:4848
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1104

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4024-0-0x0000000004D50000-0x0000000004E40000-memory.dmp
      Filesize

      960KB

      Download
    • memory/4024-1-0x0000000074D00000-0x00000000754B0000-memory.dmp
      Filesize

      7.7MB

      Download
    • memory/4024-2-0x0000000002810000-0x0000000002900000-memory.dmp
      Filesize

      960KB

      Download
    • memory/4024-3-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4024-4-0x0000000004F50000-0x00000000054F4000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4024-5-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-6-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-8-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-10-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-12-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-14-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-16-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-18-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-20-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-22-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-24-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-26-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-28-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-30-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-32-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-34-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-36-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-38-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-40-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-44-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-42-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-46-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-48-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-50-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-52-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-54-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-56-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-58-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-60-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-62-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-64-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-66-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-68-0x0000000002810000-0x00000000028FA000-memory.dmp
      Filesize

      936KB

      Download
    • memory/4024-1115-0x0000000004EB0000-0x0000000004EC0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4024-1117-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/4024-1118-0x0000000074D00000-0x00000000754B0000-memory.dmp
      Filesize

      7.7MB

      Download