Analysis
- max time kernel
150s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20240214-en - resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system - submitted
18/02/2024, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
LZMA.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
LZMA.exe
Resource
win10-20240214-en
windows10-1703-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
LZMA.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
LZMA.exe
Resource
win11-20240214-en
windows11-21h2-x64
12 signatures
150 seconds
Behavioral task
behavioral5
Sample
expatai.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
expatai.dll
Resource
win10-20240214-en
windows10-1703-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
expatai.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
expatai.dll
Resource
win11-20240214-en
windows11-21h2-x64
1 signatures
150 seconds
General
- Target LZMA.exe
- Size 388KB
- Sample240218-tmaw5ace25
- SHA256 f7369777a4fee1b2e8282f30dc355c3216e4fdc7018912f2a7444026f9edafd0
- MD5 89266366e2c712e8b47b2b9ed30d60b7
- SHA1 a94bb0440fe6c0d7a6c102037561ffbe6203a251
- SHA512 385916c9bbc9a4d7474bfcc68c4fb281e2f3d6df5c11a114b8646400f8a822a5c945f80de2d8d97547e58971b03bcada2f28fc2f259db07ea1880b3fa68b3d95
- SSDEEP 12288:1PzUcyOjaTbV7DWZzZg1iuc30Oy7CxMFr:Vz1y6AbV+qwEr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects PlugX payload 25 IoCs
resource yara_rule behavioral4/memory/3676-1-0x0000000000D00000-0x0000000000D2D000-memory.dmp family_plugx behavioral4/memory/3676-2-0x0000000000D00000-0x0000000000D2D000-memory.dmp family_plugx behavioral4/memory/892-21-0x00000000027B0000-0x00000000027DD000-memory.dmp family_plugx behavioral4/memory/892-23-0x00000000027B0000-0x00000000027DD000-memory.dmp family_plugx behavioral4/memory/228-26-0x00000000017A0000-0x00000000017CD000-memory.dmp family_plugx behavioral4/memory/228-27-0x00000000017A0000-0x00000000017CD000-memory.dmp family_plugx behavioral4/memory/4228-29-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/4228-30-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/4228-41-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/4228-42-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/4228-43-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/4228-44-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/4228-48-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/228-49-0x00000000017A0000-0x00000000017CD000-memory.dmp family_plugx behavioral4/memory/4228-50-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/3676-53-0x0000000000D00000-0x0000000000D2D000-memory.dmp family_plugx behavioral4/memory/4228-52-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/892-54-0x00000000027B0000-0x00000000027DD000-memory.dmp family_plugx behavioral4/memory/3664-56-0x0000000000F20000-0x0000000000F4D000-memory.dmp family_plugx behavioral4/memory/3664-57-0x0000000000F20000-0x0000000000F4D000-memory.dmp family_plugx behavioral4/memory/3664-59-0x0000000000F20000-0x0000000000F4D000-memory.dmp family_plugx behavioral4/memory/3664-60-0x0000000000F20000-0x0000000000F4D000-memory.dmp family_plugx behavioral4/memory/3664-61-0x0000000000F20000-0x0000000000F4D000-memory.dmp family_plugx behavioral4/memory/4228-62-0x0000000001230000-0x000000000125D000-memory.dmp family_plugx behavioral4/memory/3664-63-0x0000000000F20000-0x0000000000F4D000-memory.dmp family_plugx - Deletes itself 1 IoCs
pid Process 892 LZMA.exe - Executes dropped EXE 2 IoCs
pid Process 892 LZMA.exe 228 LZMA.exe - Loads dropped DLL 2 IoCs
pid Process 892 LZMA.exe 228 LZMA.exe - Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 182.16.12.250 Destination IP 182.16.12.250 Destination IP 182.16.12.250 - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 44003100410042004100360043004200360030004600390045004300460039000000 svchost.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4228 svchost.exe 3664 svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3676 LZMA.exe 3676 LZMA.exe 3676 LZMA.exe 3676 LZMA.exe 892 LZMA.exe 892 LZMA.exe 4228 svchost.exe 4228 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 4228 svchost.exe 4228 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 4228 svchost.exe 4228 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 4228 svchost.exe 4228 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 4228 svchost.exe 4228 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe 3664 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4228 svchost.exe 3664 svchost.exe - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3676 LZMA.exe Token: SeTcbPrivilege 3676 LZMA.exe Token: SeDebugPrivilege 892 LZMA.exe Token: SeTcbPrivilege 892 LZMA.exe Token: SeDebugPrivilege 228 LZMA.exe Token: SeTcbPrivilege 228 LZMA.exe Token: SeDebugPrivilege 4228 svchost.exe Token: SeTcbPrivilege 4228 svchost.exe Token: SeDebugPrivilege 3664 svchost.exe Token: SeTcbPrivilege 3664 svchost.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 228 wrote to memory of 4228 228 LZMA.exe 86 PID 4228 wrote to memory of 3664 4228 svchost.exe 87 PID 4228 wrote to memory of 3664 4228 svchost.exe 87 PID 4228 wrote to memory of 3664 4228 svchost.exe 87 PID 4228 wrote to memory of 3664 4228 svchost.exe 87 PID 4228 wrote to memory of 3664 4228 svchost.exe 87 PID 4228 wrote to memory of 3664 4228 svchost.exe 87 PID 4228 wrote to memory of 3664 4228 svchost.exe 87 PID 4228 wrote to memory of 3664 4228 svchost.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\LZMA.exe"C:\Users\Admin\AppData\Local\Temp\LZMA.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
C:\ProgramData\Microsoft\CryptSvcser\LZMA.exe"C:\ProgramData\Microsoft\CryptSvcser\LZMA.exe" 100 36761⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:892
-
C:\ProgramData\Microsoft\CryptSvcser\LZMA.exe"C:\ProgramData\Microsoft\CryptSvcser\LZMA.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 209 42283⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3664
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\CryptSvcser\LZMA.exe
- Size 388KB
- SHA256 f7369777a4fee1b2e8282f30dc355c3216e4fdc7018912f2a7444026f9edafd0
- MD5 89266366e2c712e8b47b2b9ed30d60b7
- SHA1 a94bb0440fe6c0d7a6c102037561ffbe6203a251
- SHA512 385916c9bbc9a4d7474bfcc68c4fb281e2f3d6df5c11a114b8646400f8a822a5c945f80de2d8d97547e58971b03bcada2f28fc2f259db07ea1880b3fa68b3d95
- SSDEEP 12288:1PzUcyOjaTbV7DWZzZg1iuc30Oy7CxMFr:Vz1y6AbV+qwEr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\CryptSvcser\expatai.dll
- Size 400KB
- SHA256 ed10a005bbab4385775e5964586bad0c1d267edbf87ce98feb3cc7135877cca1
- MD5 dd55071ced298687339566cbe9b23c40
- SHA1 1b5f760daab97658f7c0f7c28db35f10bde761bb
- SHA512 ae9753860775be0039463c408e080a2541465562702c2407b46d3ab15dacdae6721325eb60ae72e0b389da2524e6122593a6f9bf42f1c2df5c2cb8463c4026c8
- SSDEEP 6144:0iKR+8NAOuiLSswqA5YcgU8IoIkfvvIsAOIjAOktasHaF:U+8TSpqA5Yo1kfvvIsqjM6F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\Microsoft\CryptSvcser\update.log
- Size 228KB
- SHA256 8a7e960d9aefce2bc6c515e63a46ea5d6e7db964301eb8a26c3dd561707eac77
- MD5 fc5100b1fc7e642bf76fdc3df1846df5
- SHA1 664d22bc60a7cd08b8ba5aee9f045fa21de719cb
- SHA512 46cc8e84c7e5668e4fa5da0eabab725da2c5c93bfcce6d7774e668b3e011c6f24d9e0513aac097366504e1139525879b9a43b128c37c719c0a25401ceb9fbe47
- SSDEEP 6144:QoDawc6VrRq/xRCLSWzXJ8NNPTnurTEQsoHhR3:QnwcgaxRWDaNVnu8QHZ
- MD5 SHA1 SHA512 SSDEEP