Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2024 14:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
客户端/20201108/D3DX81ab.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
客户端/20201108/D3DX81ab.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
客户端/20201108/libcro.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
客户端/20201108/libcro.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
客户端/20201108/管理程序.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
General
-
Target
客户端/20201108/管理程序.exe
-
Size
427KB
-
MD5
04d96003c2fc885a648028b50c4b0ed0
-
SHA1
6dbcc75a74ef43a275ba90246279ece264dc7a4f
-
SHA256
ab6f2d57c89435f667a4edc72635188aee2c559c6c0b6c6272cdf18ac44c1fe1
-
SHA512
d99a8b7f97a0cdafeef07e6bc6469275f762331f4a5ecf701114ff30d2c3571befa29e47376197d164be3b2e63628bbb6e6e659c54e4e34b98a19a51900c8dbf
-
SSDEEP
12288:/Qfw5psvke4qfscp4s9fUqlXUOJyTpeaknLzZo/vo058:/QoVe4qfsM4s6hFpeakpoj8
Malware Config
Signatures
-
Detects PlugX payload 21 IoCs
resource yara_rule behavioral6/memory/3756-2-0x0000000002240000-0x000000000226D000-memory.dmp family_plugx behavioral6/memory/4940-22-0x0000000000ED0000-0x0000000000EFD000-memory.dmp family_plugx behavioral6/memory/4940-23-0x0000000000ED0000-0x0000000000EFD000-memory.dmp family_plugx behavioral6/memory/4244-25-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-27-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-39-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-40-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-38-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-41-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-43-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/3756-46-0x0000000002240000-0x000000000226D000-memory.dmp family_plugx behavioral6/memory/4244-47-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-49-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-50-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4244-52-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4736-55-0x0000000001540000-0x000000000156D000-memory.dmp family_plugx behavioral6/memory/4736-57-0x0000000001540000-0x000000000156D000-memory.dmp family_plugx behavioral6/memory/4736-58-0x0000000001540000-0x000000000156D000-memory.dmp family_plugx behavioral6/memory/4736-59-0x0000000001540000-0x000000000156D000-memory.dmp family_plugx behavioral6/memory/4244-60-0x00000000018D0000-0x00000000018FD000-memory.dmp family_plugx behavioral6/memory/4736-61-0x0000000001540000-0x000000000156D000-memory.dmp family_plugx -
Unexpected DNS network traffic destination 12 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 205.252.144.228 Destination IP 202.98.96.68 Destination IP 61.139.2.69 Destination IP 205.252.144.228 Destination IP 61.139.2.69 Destination IP 202.98.96.68 Destination IP 205.252.144.228 Destination IP 202.98.96.68 Destination IP 61.139.2.69 Destination IP 61.139.2.69 Destination IP 202.98.96.68 Destination IP 205.252.144.228 -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 30004400460041004400310036004600430046004600440033003400380041000000 svchost.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4244 svchost.exe 4736 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3756 管理程序.exe 3756 管理程序.exe 3756 管理程序.exe 3756 管理程序.exe 4244 svchost.exe 4244 svchost.exe 4244 svchost.exe 4244 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4244 svchost.exe 4244 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4244 svchost.exe 4244 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4244 svchost.exe 4244 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4244 svchost.exe 4244 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe 4736 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4244 svchost.exe 4736 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 3756 管理程序.exe Token: SeTcbPrivilege 3756 管理程序.exe Token: SeDebugPrivilege 4940 管理程序.exe Token: SeTcbPrivilege 4940 管理程序.exe Token: SeDebugPrivilege 4244 svchost.exe Token: SeTcbPrivilege 4244 svchost.exe Token: SeDebugPrivilege 4736 svchost.exe Token: SeTcbPrivilege 4736 svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4940 wrote to memory of 4244 4940 管理程序.exe 104 PID 4244 wrote to memory of 4736 4244 svchost.exe 106 PID 4244 wrote to memory of 4736 4244 svchost.exe 106 PID 4244 wrote to memory of 4736 4244 svchost.exe 106 PID 4244 wrote to memory of 4736 4244 svchost.exe 106 PID 4244 wrote to memory of 4736 4244 svchost.exe 106 PID 4244 wrote to memory of 4736 4244 svchost.exe 106 PID 4244 wrote to memory of 4736 4244 svchost.exe 106 PID 4244 wrote to memory of 4736 4244 svchost.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\客户端\20201108\管理程序.exe"C:\Users\Admin\AppData\Local\Temp\客户端\20201108\管理程序.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756
-
C:\Users\Admin\AppData\Local\Temp\客户端\20201108\管理程序.exe"C:\Users\Admin\AppData\Local\Temp\客户端\20201108\管理程序.exe" 200 01⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 209 42443⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1412 --field-trial-handle=2244,i,861925222566734100,5228329984880658054,262144 --variations-seed-version /prefetch:81⤵PID:4624