Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-04-2024 10:21

General

  • Target

    369e74a8e1f686896f82d92ee2467ca6736bc44b06faab9db9ea6473aef4c397.exe

  • Size

    697KB

  • MD5

    48ab8b5189e1fae02258e9e82a964e51

  • SHA1

    1a8dc7545033f3a17cf47b43313ce2fba7a71e78

  • SHA256

    369e74a8e1f686896f82d92ee2467ca6736bc44b06faab9db9ea6473aef4c397

  • SHA512

    0d03ab2dc67d34f1fc922c1b0b4afb213021adf4d8460b2c2d30621362db50cc2f99e3b5755ee4f4a7d358cb73e7eeee71102e91bc0ac932bf86e4900e9e48bf

  • SSDEEP

    12288:YUomEFRu3xEPE6wr0AgMw3GPWyf50YiYjnpYzQxANb3B0G+tUfeI6t5:YmOMSPE6w47Iv5036YzQguGMVI+5

Score
10/10

Malware Config

Signatures

  • Detects PlugX payload 26 IoCs
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 8 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\369e74a8e1f686896f82d92ee2467ca6736bc44b06faab9db9ea6473aef4c397.exe
    "C:\Users\Admin\AppData\Local\Temp\369e74a8e1f686896f82d92ee2467ca6736bc44b06faab9db9ea6473aef4c397.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Users\Admin\AppData\Local\Temp\adb.exe
      "C:\Users\Admin\AppData\Local\Temp\adb.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3048
  • C:\ProgramData\adb\adb.exe
    "C:\ProgramData\adb\adb.exe" 100 3048
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    PID:2624
  • C:\ProgramData\adb\adb.exe
    "C:\ProgramData\adb\adb.exe" 200 0
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe 201 0
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2976
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\system32\msiexec.exe 209 2976
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:1940

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\AdbWinApi.dat

    Filesize

    148KB

    MD5

    cbcc0845497ddd773399e0f095539a4c

    SHA1

    6c878e4ee18d14b94a3214bdd283b221a1981877

    SHA256

    88045766007380b99fa7874c633d66bcb17d3314b6145ad5f8d8216e8e24b375

    SHA512

    e9a237e1ed9a53ce52c52ed40c43073430bc54b36996c53a90ab7524c0e3a3c9d8fa403b4f0ee52997f19d4d720f7d9db8efa7e988ca53efc221573a05a8e38f

  • \Users\Admin\AppData\Local\Temp\AdbWinApi.dll

    Filesize

    33KB

    MD5

    114d0cdadcbdec8c6baa9af0a869700a

    SHA1

    a794329bac18d02b891b0e24ec73d88da4fe3404

    SHA256

    9217518710b77766d9dc3397c3ce9bd88734c71c8b80a2dd1e9ed1312efacd9c

    SHA512

    edab7b4ee16d7e8797d297c6e3add9b2b685b732d51a9c1b3994f8cf21c285fb3a2198d02536168d2153711eb4ed925ad602459c70def4c5c7cbff5ec12d6a3f

  • \Users\Admin\AppData\Local\Temp\adb.exe

    Filesize

    804KB

    MD5

    790fb1184a3ed8e475263daa54f98469

    SHA1

    37a60f670a4f3c68a4872ec2e95c0be2bd130dae

    SHA256

    ef4c7f4c417c18cd3394dd81ccd94381af252e0af81b0ad89b7e6d81412f4706

    SHA512

    66a2325c59a7fdacd049f43b528224682245c2705f10c50a907b6454d5755522b9d9d07046426d42db8c324ba95adbde1de087e31a0fb21b635c1dc4ca25a4f8

  • memory/1940-98-0x0000000000320000-0x0000000000355000-memory.dmp

    Filesize

    212KB

  • memory/1940-96-0x0000000000320000-0x0000000000355000-memory.dmp

    Filesize

    212KB

  • memory/1940-100-0x0000000000320000-0x0000000000355000-memory.dmp

    Filesize

    212KB

  • memory/1940-94-0x0000000000320000-0x0000000000355000-memory.dmp

    Filesize

    212KB

  • memory/1940-95-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/1940-102-0x0000000000320000-0x0000000000355000-memory.dmp

    Filesize

    212KB

  • memory/1940-97-0x0000000000320000-0x0000000000355000-memory.dmp

    Filesize

    212KB

  • memory/1940-99-0x0000000000320000-0x0000000000355000-memory.dmp

    Filesize

    212KB

  • memory/2512-51-0x0000000001E80000-0x0000000001EB5000-memory.dmp

    Filesize

    212KB

  • memory/2512-56-0x0000000001E80000-0x0000000001EB5000-memory.dmp

    Filesize

    212KB

  • memory/2512-61-0x0000000000400000-0x00000000004E1000-memory.dmp

    Filesize

    900KB

  • memory/2624-47-0x0000000000650000-0x0000000000685000-memory.dmp

    Filesize

    212KB

  • memory/2624-46-0x0000000000650000-0x0000000000685000-memory.dmp

    Filesize

    212KB

  • memory/2624-85-0x0000000000650000-0x0000000000685000-memory.dmp

    Filesize

    212KB

  • memory/2976-84-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-62-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-74-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2976-75-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-76-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-77-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-79-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-80-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-81-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-82-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-101-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-52-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2976-58-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/2976-57-0x00000000002C0000-0x00000000002F5000-memory.dmp

    Filesize

    212KB

  • memory/2976-55-0x0000000000110000-0x0000000000112000-memory.dmp

    Filesize

    8KB

  • memory/2976-54-0x00000000000A0000-0x00000000000C4000-memory.dmp

    Filesize

    144KB

  • memory/3048-68-0x0000000000400000-0x00000000004E1000-memory.dmp

    Filesize

    900KB

  • memory/3048-26-0x0000000001DB0000-0x0000000001DE5000-memory.dmp

    Filesize

    212KB

  • memory/3048-27-0x0000000001DB0000-0x0000000001DE5000-memory.dmp

    Filesize

    212KB

  • memory/3048-66-0x0000000001DB0000-0x0000000001DE5000-memory.dmp

    Filesize

    212KB

  • memory/3048-25-0x0000000001E70000-0x0000000001F70000-memory.dmp

    Filesize

    1024KB