plugx | 45c944889a482ae2e0e0a8e260c3be737cb612c8804164badef61e8a8713b92f

General

Target

RasTls.exe
Size

105KB
MD5

62944e26b36b1dcace429ae26ba66164
SHA1

2616da1697f7c764ee7fb558887a6a3279861fac
SHA256

f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68
SHA512

e3c366044ac0b4df834b2f05d900cad01bc55b39028984ed3486aa2522e8c226bf9a81952da2c7e4bf0bc2c322d10fe58329e787238bb710a137827927b48d7c
SSDEEP

1536:To0lZUH+MeI1M04n45PFmsMfgiqf5YXneJ07soW8VD5cN:TOw4jYgiqf5yh7sl8VF

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects Talisman variant of PlugX 15 IoCs

Processes:

resource	yara_rule
behavioral3/memory/2952-2-0x0000000001BF0000-0x0000000001C29000-memory.dmp	family_plugx_talisman
behavioral3/memory/2952-3-0x0000000001BF0000-0x0000000001C29000-memory.dmp	family_plugx_talisman
behavioral3/memory/2952-16-0x0000000001BF0000-0x0000000001C29000-memory.dmp	family_plugx_talisman
behavioral3/memory/2296-24-0x0000000000460000-0x0000000000499000-memory.dmp	family_plugx_talisman
behavioral3/memory/2296-25-0x0000000000460000-0x0000000000499000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-31-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-32-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2296-33-0x0000000000460000-0x0000000000499000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-36-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-37-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-38-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-39-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-40-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-41-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman
behavioral3/memory/2504-42-0x0000000000410000-0x0000000000449000-memory.dmp	family_plugx_talisman

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 1 IoCs

Processes:

RasTls.exe

pid process

2296 RasTls.exe
Loads dropped DLL 1 IoCs

Processes:

RasTls.exe

pid process

2296 RasTls.exe

pid	process
2296	RasTls.exe

pid	process
2296	RasTls.exe

Drops file in System32 directory 1 IoCs

Processes:

nslookup.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	nslookup.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2656 schtasks.exe

pid	process
2656	schtasks.exe

Modifies data under HKEY_USERS 33 IoCs

Processes:

nslookup.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadDecisionTime = f0dc6b12348bda01	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\ea-0e-c6-f9-27-49	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform	nslookup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f005e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadDecisionReason = "1"	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	nslookup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	nslookup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	nslookup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadNetworkName = "Network 3"	nslookup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49\WpadDecisionTime = f0dc6b12348bda01	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	nslookup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}\WpadDecision = "0"	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49\WpadDecisionReason = "1"	nslookup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{16B8C21C-FCFD-4320-935D-98F49C0D03A4}	nslookup.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	nslookup.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	nslookup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-0e-c6-f9-27-49\WpadDecision = "0"	nslookup.exe

Modifies registry class 2 IoCs

Processes:

nslookup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	nslookup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 35004500420032003600340042004600300042003900300036003100320030000000	nslookup.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

nslookup.exe

pid process

2504 nslookup.exe
2504 nslookup.exe
2504 nslookup.exe

pid	process
2504	nslookup.exe
2504	nslookup.exe
2504	nslookup.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RasTls.exeRasTls.exenslookup.exe

description	pid	process
Token: SeDebugPrivilege	2952	RasTls.exe
Token: SeTcbPrivilege	2952	RasTls.exe
Token: SeDebugPrivilege	2296	RasTls.exe
Token: SeTcbPrivilege	2296	RasTls.exe
Token: SeDebugPrivilege	2504	nslookup.exe
Token: SeTcbPrivilege	2504	nslookup.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

RasTls.execmd.execmd.exetaskeng.exeRasTls.exe

description	pid	process	target process
PID 2952 wrote to memory of 3052	2952	RasTls.exe	cmd.exe
PID 2952 wrote to memory of 3052	2952	RasTls.exe	cmd.exe
PID 2952 wrote to memory of 3052	2952	RasTls.exe	cmd.exe
PID 2952 wrote to memory of 3052	2952	RasTls.exe	cmd.exe
PID 2952 wrote to memory of 2580	2952	RasTls.exe	cmd.exe
PID 2952 wrote to memory of 2580	2952	RasTls.exe	cmd.exe
PID 2952 wrote to memory of 2580	2952	RasTls.exe	cmd.exe
PID 2952 wrote to memory of 2580	2952	RasTls.exe	cmd.exe
PID 3052 wrote to memory of 2544	3052	cmd.exe	schtasks.exe
PID 3052 wrote to memory of 2544	3052	cmd.exe	schtasks.exe
PID 3052 wrote to memory of 2544	3052	cmd.exe	schtasks.exe
PID 3052 wrote to memory of 2544	3052	cmd.exe	schtasks.exe
PID 2580 wrote to memory of 2656	2580	cmd.exe	schtasks.exe
PID 2580 wrote to memory of 2656	2580	cmd.exe	schtasks.exe
PID 2580 wrote to memory of 2656	2580	cmd.exe	schtasks.exe
PID 2580 wrote to memory of 2656	2580	cmd.exe	schtasks.exe
PID 2476 wrote to memory of 2296	2476	taskeng.exe	RasTls.exe
PID 2476 wrote to memory of 2296	2476	taskeng.exe	RasTls.exe
PID 2476 wrote to memory of 2296	2476	taskeng.exe	RasTls.exe
PID 2476 wrote to memory of 2296	2476	taskeng.exe	RasTls.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe
PID 2296 wrote to memory of 2504	2296	RasTls.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\RasTls.exe
"C:\Users\Admin\AppData\Local\Temp\RasTls.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952
- \??\c:\windows\SysWOW64\cmd.exe
  c:\windows\system32\cmd.exe /c c:\windows\system32\schtasks.exe /delete /tn "SymantecRasTls" /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3052
- - \??\c:\windows\SysWOW64\schtasks.exe
    c:\windows\system32\schtasks.exe /delete /tn "SymantecRasTls" /F
    3⤵
    PID:2544
- \??\c:\windows\SysWOW64\cmd.exe
  c:\windows\system32\cmd.exe /c c:\windows\system32\schtasks.exe /create /sc minute /mo 2 /tn "SymantecRasTls" /tr "\"C:\ProgramData\SymantecRasTls\RasTls.exe\"" /ru "system"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - \??\c:\windows\SysWOW64\schtasks.exe
    c:\windows\system32\schtasks.exe /create /sc minute /mo 2 /tn "SymantecRasTls" /tr "\"C:\ProgramData\SymantecRasTls\RasTls.exe\"" /ru "system"
    3⤵
    - Creates scheduled task(s)
    PID:2656

C:\Windows\system32\taskeng.exe
taskeng.exe {5739FB93-B851-4677-AE9B-512D5C3904EE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\ProgramData\SymantecRasTls\RasTls.exe
  C:\ProgramData\SymantecRasTls\RasTls.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2296
- - C:\Windows\SysWOW64\nslookup.exe
    C:\Windows\system32\nslookup.exe 201 0
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SymantecRasTls\RasTls.dll

Filesize
3KB

MD5
d5915394a6916a00c426aa2827d97c0e

SHA1
50064d66c9b55b6f7d22051b81914d8366fe36c8

SHA256
6cd5079a69d9a68029e37f2680f44b7ba71c2b1eecf4894c2a8b293d5f768f10

SHA512
56aa607a5a1bf095b017fd23a1007795f4bdd3a5a5efe571f7c74b7a4e37fb88f3031c26b5189e9f67328222b3dda621a7379da5341bfa95e25605b703ea6373

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.dll.res

Filesize
136KB

MD5
9ae8a7837c60f3f587701934ff41bd96

SHA1
ea7595bff1cfd1d72fe72417bf263d9adc9bc59e

SHA256
37b3fb9aa12277f355bbb334c82b41e4155836cf3a1b83e543ce53da9d429e2f

SHA512
61ba5240b9a2376f8c88616b229323f71775639d1629467847260d555251b5d9b9e36a7858d8ff1601e3661163020219c2b3192997acd323bf58b27f8ed2efe2

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.exe

Filesize
105KB

MD5
62944e26b36b1dcace429ae26ba66164

SHA1
2616da1697f7c764ee7fb558887a6a3279861fac

SHA256
f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68

SHA512
e3c366044ac0b4df834b2f05d900cad01bc55b39028984ed3486aa2522e8c226bf9a81952da2c7e4bf0bc2c322d10fe58329e787238bb710a137827927b48d7c

Download Submit
memory/2296-35-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2296-33-0x0000000000460000-0x0000000000499000-memory.dmp

Filesize
228KB

Download
memory/2296-25-0x0000000000460000-0x0000000000499000-memory.dmp

Filesize
228KB

Download
memory/2296-24-0x0000000000460000-0x0000000000499000-memory.dmp

Filesize
228KB

Download
memory/2296-23-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2504-29-0x00000000000D0000-0x00000000000D2000-memory.dmp

Filesize
8KB

Download
memory/2504-32-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-42-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-41-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-26-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2504-28-0x00000000000A0000-0x00000000000C1000-memory.dmp

Filesize
132KB

Download
memory/2504-40-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-30-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2504-31-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-39-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-38-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-34-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2504-37-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2504-36-0x0000000000410000-0x0000000000449000-memory.dmp

Filesize
228KB

Download
memory/2952-1-0x0000000000280000-0x00000000002A3000-memory.dmp

Filesize
140KB

Download
memory/2952-2-0x0000000001BF0000-0x0000000001C29000-memory.dmp

Filesize
228KB

Download
memory/2952-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2952-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2952-3-0x0000000001BF0000-0x0000000001C29000-memory.dmp

Filesize
228KB

Download
memory/2952-16-0x0000000001BF0000-0x0000000001C29000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads