plugx | 45c944889a482ae2e0e0a8e260c3be737cb612c8804164badef61e8a8713b92f

General

Target

RasTls.exe
Size

105KB
MD5

62944e26b36b1dcace429ae26ba66164
SHA1

2616da1697f7c764ee7fb558887a6a3279861fac
SHA256

f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68
SHA512

e3c366044ac0b4df834b2f05d900cad01bc55b39028984ed3486aa2522e8c226bf9a81952da2c7e4bf0bc2c322d10fe58329e787238bb710a137827927b48d7c
SSDEEP

1536:To0lZUH+MeI1M04n45PFmsMfgiqf5YXneJ07soW8VD5cN:TOw4jYgiqf5yh7sl8VF

Score

10^/10

plugx trojan

Malware Config

Signatures

Detects Talisman variant of PlugX 12 IoCs

Processes:

resource	yara_rule
behavioral4/memory/1832-2-0x0000000002120000-0x0000000002159000-memory.dmp	family_plugx_talisman
behavioral4/memory/1832-3-0x0000000002120000-0x0000000002159000-memory.dmp	family_plugx_talisman
behavioral4/memory/1832-16-0x0000000002120000-0x0000000002159000-memory.dmp	family_plugx_talisman
behavioral4/memory/3008-24-0x0000000000D90000-0x0000000000DC9000-memory.dmp	family_plugx_talisman
behavioral4/memory/3008-25-0x0000000000D90000-0x0000000000DC9000-memory.dmp	family_plugx_talisman
behavioral4/memory/3528-27-0x0000000000E20000-0x0000000000E59000-memory.dmp	family_plugx_talisman
behavioral4/memory/3528-28-0x0000000000E20000-0x0000000000E59000-memory.dmp	family_plugx_talisman
behavioral4/memory/3008-29-0x0000000000D90000-0x0000000000DC9000-memory.dmp	family_plugx_talisman
behavioral4/memory/3528-32-0x0000000000E20000-0x0000000000E59000-memory.dmp	family_plugx_talisman
behavioral4/memory/3528-33-0x0000000000E20000-0x0000000000E59000-memory.dmp	family_plugx_talisman
behavioral4/memory/3528-34-0x0000000000E20000-0x0000000000E59000-memory.dmp	family_plugx_talisman
behavioral4/memory/3528-35-0x0000000000E20000-0x0000000000E59000-memory.dmp	family_plugx_talisman

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Executes dropped EXE 1 IoCs

Processes:

RasTls.exe

pid process

3008 RasTls.exe
Loads dropped DLL 1 IoCs

Processes:

RasTls.exe

pid process

3008 RasTls.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2592 schtasks.exe

pid	process
3008	RasTls.exe

pid	process
3008	RasTls.exe

pid	process
2592	schtasks.exe

Modifies registry class 2 IoCs

Processes:

nslookup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	nslookup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 45003600450037003500450036004100300031004500440032003600460031000000	nslookup.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

nslookup.exe

pid process

3528 nslookup.exe
3528 nslookup.exe
3528 nslookup.exe
3528 nslookup.exe

pid	process
3528	nslookup.exe
3528	nslookup.exe
3528	nslookup.exe
3528	nslookup.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RasTls.exeRasTls.exenslookup.exe

description	pid	process
Token: SeDebugPrivilege	1832	RasTls.exe
Token: SeTcbPrivilege	1832	RasTls.exe
Token: SeDebugPrivilege	3008	RasTls.exe
Token: SeTcbPrivilege	3008	RasTls.exe
Token: SeDebugPrivilege	3528	nslookup.exe
Token: SeTcbPrivilege	3528	nslookup.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

RasTls.execmd.execmd.exeRasTls.exe

description	pid	process	target process
PID 1832 wrote to memory of 1952	1832	RasTls.exe	cmd.exe
PID 1832 wrote to memory of 1952	1832	RasTls.exe	cmd.exe
PID 1832 wrote to memory of 1952	1832	RasTls.exe	cmd.exe
PID 1952 wrote to memory of 3844	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 3844	1952	cmd.exe	schtasks.exe
PID 1952 wrote to memory of 3844	1952	cmd.exe	schtasks.exe
PID 1832 wrote to memory of 536	1832	RasTls.exe	cmd.exe
PID 1832 wrote to memory of 536	1832	RasTls.exe	cmd.exe
PID 1832 wrote to memory of 536	1832	RasTls.exe	cmd.exe
PID 536 wrote to memory of 2592	536	cmd.exe	schtasks.exe
PID 536 wrote to memory of 2592	536	cmd.exe	schtasks.exe
PID 536 wrote to memory of 2592	536	cmd.exe	schtasks.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe
PID 3008 wrote to memory of 3528	3008	RasTls.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\RasTls.exe
"C:\Users\Admin\AppData\Local\Temp\RasTls.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- \??\c:\windows\SysWOW64\cmd.exe
  c:\windows\system32\cmd.exe /c c:\windows\system32\schtasks.exe /delete /tn "SymantecRasTls" /F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - \??\c:\windows\SysWOW64\schtasks.exe
    c:\windows\system32\schtasks.exe /delete /tn "SymantecRasTls" /F
    3⤵
    PID:3844
- \??\c:\windows\SysWOW64\cmd.exe
  c:\windows\system32\cmd.exe /c c:\windows\system32\schtasks.exe /create /sc minute /mo 2 /tn "SymantecRasTls" /tr "\"C:\ProgramData\SymantecRasTls\RasTls.exe\"" /ru "system"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - \??\c:\windows\SysWOW64\schtasks.exe
    c:\windows\system32\schtasks.exe /create /sc minute /mo 2 /tn "SymantecRasTls" /tr "\"C:\ProgramData\SymantecRasTls\RasTls.exe\"" /ru "system"
    3⤵
    - Creates scheduled task(s)
    PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4760

C:\ProgramData\SymantecRasTls\RasTls.exe
C:\ProgramData\SymantecRasTls\RasTls.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\nslookup.exe
  C:\Windows\system32\nslookup.exe 201 0
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SymantecRasTls\RasTls.dll

Filesize
3KB

MD5
d5915394a6916a00c426aa2827d97c0e

SHA1
50064d66c9b55b6f7d22051b81914d8366fe36c8

SHA256
6cd5079a69d9a68029e37f2680f44b7ba71c2b1eecf4894c2a8b293d5f768f10

SHA512
56aa607a5a1bf095b017fd23a1007795f4bdd3a5a5efe571f7c74b7a4e37fb88f3031c26b5189e9f67328222b3dda621a7379da5341bfa95e25605b703ea6373

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.dll.res

Filesize
136KB

MD5
9ae8a7837c60f3f587701934ff41bd96

SHA1
ea7595bff1cfd1d72fe72417bf263d9adc9bc59e

SHA256
37b3fb9aa12277f355bbb334c82b41e4155836cf3a1b83e543ce53da9d429e2f

SHA512
61ba5240b9a2376f8c88616b229323f71775639d1629467847260d555251b5d9b9e36a7858d8ff1601e3661163020219c2b3192997acd323bf58b27f8ed2efe2

Download Submit
C:\ProgramData\SymantecRasTls\RasTls.exe

Filesize
105KB

MD5
62944e26b36b1dcace429ae26ba66164

SHA1
2616da1697f7c764ee7fb558887a6a3279861fac

SHA256
f9ebf6aeb3f0fb0c29bd8f3d652476cd1fe8bd9a0c11cb15c43de33bbce0bf68

SHA512
e3c366044ac0b4df834b2f05d900cad01bc55b39028984ed3486aa2522e8c226bf9a81952da2c7e4bf0bc2c322d10fe58329e787238bb710a137827927b48d7c

Download Submit
memory/1832-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1832-1-0x0000000002050000-0x0000000002073000-memory.dmp

Filesize
140KB

Download
memory/1832-2-0x0000000002120000-0x0000000002159000-memory.dmp

Filesize
228KB

Download
memory/1832-3-0x0000000002120000-0x0000000002159000-memory.dmp

Filesize
228KB

Download
memory/1832-16-0x0000000002120000-0x0000000002159000-memory.dmp

Filesize
228KB

Download
memory/1832-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3008-24-0x0000000000D90000-0x0000000000DC9000-memory.dmp

Filesize
228KB

Download
memory/3008-23-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3008-25-0x0000000000D90000-0x0000000000DC9000-memory.dmp

Filesize
228KB

Download
memory/3008-29-0x0000000000D90000-0x0000000000DC9000-memory.dmp

Filesize
228KB

Download
memory/3008-30-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3528-26-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/3528-27-0x0000000000E20000-0x0000000000E59000-memory.dmp

Filesize
228KB

Download
memory/3528-28-0x0000000000E20000-0x0000000000E59000-memory.dmp

Filesize
228KB

Download
memory/3528-31-0x0000000000A20000-0x0000000000A21000-memory.dmp

Filesize
4KB

Download
memory/3528-32-0x0000000000E20000-0x0000000000E59000-memory.dmp

Filesize
228KB

Download
memory/3528-33-0x0000000000E20000-0x0000000000E59000-memory.dmp

Filesize
228KB

Download
memory/3528-34-0x0000000000E20000-0x0000000000E59000-memory.dmp

Filesize
228KB

Download
memory/3528-35-0x0000000000E20000-0x0000000000E59000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads