Analysis
- max time kernel
149s - max time network
142s - platform
windows10-1703_x64 - resource
win10-20240214-en - resource tags
- submitted
26/02/2024, 12:29
General
- Target DeElevator.exe
- Size 10KB
- Sample240226-ppdnksde62
- SHA256 22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4
Malware Config
Signatures
- Detects PlugX payload 25 IoCs
- PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
- Deletes itself 1 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies registry class 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\DeElevator.exe"C:\Users\Admin\AppData\Local\Temp\DeElevator.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe"C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe" 100 2121⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe"C:\ProgramData\Microsoft\MapACASvc\DeElevator.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe 209 11323⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
DeElevator.exe
DeElevator64.dll
Private.USO
memory/212-0-0x00007FF5FFDD0000-0x00007FF5FFED0000-memory.dmp
memory/212-3-0x0000000000050000-0x0000000000099000-memory.dmp
memory/212-39-0x0000000000050000-0x0000000000099000-memory.dmp
memory/1132-59-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-62-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-57-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-36-0x000002505F1E0000-0x000002505F240000-memory.dmp
memory/1132-75-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-41-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-43-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-47-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-53-0x000002505F3B0000-0x000002505F3B1000-memory.dmp
memory/1132-54-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-55-0x000002505F310000-0x000002505F359000-memory.dmp
memory/1132-56-0x000002505F310000-0x000002505F359000-memory.dmp
memory/2152-34-0x0000000000C80000-0x0000000000CC9000-memory.dmp
memory/2152-37-0x0000000000C80000-0x0000000000CC9000-memory.dmp
memory/2276-27-0x0000000000050000-0x0000000000099000-memory.dmp
memory/2276-63-0x0000000000050000-0x0000000000099000-memory.dmp
memory/2276-29-0x0000000000050000-0x0000000000099000-memory.dmp
memory/4348-67-0x0000019CE7710000-0x0000019CE7759000-memory.dmp
memory/4348-70-0x0000019CE7710000-0x0000019CE7759000-memory.dmp
memory/4348-71-0x0000019CE7AB0000-0x0000019CE7AB1000-memory.dmp
memory/4348-72-0x0000019CE7710000-0x0000019CE7759000-memory.dmp
memory/4348-74-0x0000019CE7710000-0x0000019CE7759000-memory.dmp
memory/4348-73-0x0000019CE7710000-0x0000019CE7759000-memory.dmp
memory/4348-76-0x0000019CE7710000-0x0000019CE7759000-memory.dmp