Analysis
- max time kernel
150s - max time network
146s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
26/02/2024, 12:29
General
- Target DeElevator.exe
- Size 10KB
- Sample240226-ppdnksde62
- SHA256 22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4
Malware Config
Signatures
- Detects PlugX payload 25 IoCs
- PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
- Deletes itself 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DeElevator.exe"C:\Users\Admin\AppData\Local\Temp\DeElevator.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe"C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe" 100 19241⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe"C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe 209 24403⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DeElevator.exe
DeElevator64.dll
Private.USO
memory/1508-81-0x00000000006E0000-0x0000000000729000-memory.dmp
memory/1508-79-0x00000000006E0000-0x0000000000729000-memory.dmp
memory/1508-78-0x00000000006E0000-0x0000000000729000-memory.dmp
memory/1508-77-0x00000000006E0000-0x0000000000729000-memory.dmp
memory/1508-76-0x0000000000200000-0x0000000000201000-memory.dmp
memory/1508-75-0x00000000006E0000-0x0000000000729000-memory.dmp
memory/1508-73-0x00000000006E0000-0x0000000000729000-memory.dmp
memory/1924-4-0x0000000000030000-0x0000000000079000-memory.dmp
memory/1924-2-0x0000000000030000-0x0000000000079000-memory.dmp
memory/1924-47-0x0000000000030000-0x0000000000079000-memory.dmp
memory/1924-0-0x000007FFFFEB0000-0x000007FFFFFB0000-memory.dmp
memory/2440-64-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-39-0x0000000000130000-0x0000000000190000-memory.dmp
memory/2440-59-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-58-0x0000000000360000-0x0000000000361000-memory.dmp
memory/2440-60-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-61-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-62-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-44-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-80-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-48-0x0000000000060000-0x00000000000A9000-memory.dmp
memory/2440-42-0x0000000000130000-0x0000000000190000-memory.dmp
memory/2564-43-0x0000000000030000-0x0000000000079000-memory.dmp
memory/2564-40-0x0000000000030000-0x0000000000079000-memory.dmp
memory/2564-37-0x0000000000030000-0x0000000000079000-memory.dmp
memory/2612-30-0x0000000000030000-0x0000000000079000-memory.dmp
memory/2612-68-0x0000000000030000-0x0000000000079000-memory.dmp
memory/2612-28-0x0000000000030000-0x0000000000079000-memory.dmp