Overview

overview

10

Static

static

3

ToDeSK_X64....7.exe

windows7-x64

10

ToDeSK_X64....7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2024, 17:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ToDeSK_X64_4.7.4.7.exe
  • Size 56.3MB
  • Sample240915-vpe5asteph
  • SHA256 0e494e451e402ab67b754b81a933600fe49c71a780c9aebb85153708938ba3b2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
plugxdiscoverytrojan

Malware Config

Signatures

  • Detects PlugX payload 16 IoCs
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 18 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ToDeSK_X64_4.7.4.7.exe
    "C:\Users\Admin\AppData\Local\Temp\ToDeSK_X64_4.7.4.7.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Hainan YouQu Technology Co., Ltd\ToDesk 4.8.4.8\install\ToDesk.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ToDeSK_X64_4.7.4.7.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup "
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:1364
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4647F1860DAB83ECD213F1C36C6B005C C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:4948
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 0FD19396F336EA8FF364C6887C86BC2C C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3824
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1524
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 07030727D6FEF055F72C6356E27FFB79
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3444
      • C:\Program Files\ToDesk\ToDesk.exe
        "C:\Program Files\ToDesk\ToDesk.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:3156
      • C:\Program Files\ToDesk\Tools\wmicode.exe
        "C:\Program Files\ToDesk\Tools\wmicode.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe 100 1464
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1232
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:2588
    • C:\ProgramData\NVIDIASmart\SxS.exe
      "C:\ProgramData\NVIDIASmart\SxS.exe" 200 0
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe 201 0
        2⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:112
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\system32\msiexec.exe 209 112
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          PID:556
    • C:\Program Files\ToDesk\ToDesk.exe
      "C:\Program Files\ToDesk\ToDesk.exe" --runservice
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Program Files\ToDesk\ToDesk.exe
        "C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=35600
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:4060
      • C:\Program Files\ToDesk\ToDesk.exe
        "C:\Program Files\ToDesk\ToDesk.exe" --show --localPort=35600
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3904

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e57cd05.rbs
          • Path C:\Config.Msi\e57cd05.rbs
          • Size 12KB
          • SHA256 5e05c57ca979d371388c8db94fefca27e9cff00fe51e5cf5212d6ddfb1cb5b82
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ToDesk.exe
          • Path C:\Program Files\ToDesk\ToDesk.exe
          • Size 48.4MB
          • SHA256 a9e56ee892beb3e0be3f2d412a2b4448c5a41b28fe2a15a40798faa119d4025c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wmicode.exe
          • Path C:\Program Files\ToDesk\Tools\wmicode.exe
          • Size 122KB
          • SHA256 d5d9fefd7a79ba0c121ba76d0cd51f9520effc490424978bd341f130ec835455
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wmicodegen.dll
          • Path C:\Program Files\ToDesk\Tools\wmicodegen.dll
          • Size 9KB
          • SHA256 984688673feded09962a0b4feeec8116ae860c520b0e5d630ff0df2de351b90b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wmidll.dat
          • Path C:\Program Files\ToDesk\Tools\wmidll.dat
          • Size 134KB
          • SHA256 627fe4631faa2d6f037228d60617c06d852b666ca2f8d48a4ae42a743454a21c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          config.ini
          • Path C:\Program Files\ToDesk\config.ini
          • Size 246B
          • SHA256 4a2e4aee4f49df94521127c40d3b12dae0bd599195a346b909ca9aa2d16e154a
          • MD5 SHA1 SHA512
          Submit Download

          config.ini
          • Path C:\Program Files\ToDesk\config.ini
          • Size 394B
          • SHA256 7f317c7dc3e9acbe188e942f141036efffcfaf7270cb7d0a03fda60889701995
          • MD5 SHA1 SHA512
          Submit Download

          config.ini
          • Path C:\Program Files\ToDesk\config.ini
          • Size 529B
          • SHA256 b660821f00dad204e1460a426456b4f88b498eda60eddd8a80d105bb70521faa
          • MD5 SHA1 SHA512
          Submit Download

          config.ini
          • Path C:\Program Files\ToDesk\config.ini
          • Size 589B
          • SHA256 561501959d6a97fc588510c929a1d55c37e9ac78157d56b1e704c75036be670f
          • MD5 SHA1 SHA512
          Submit Download

          zrtc.dll
          • Path C:\Program Files\ToDesk\zrtc.dll
          • Size 49.3MB
          • SHA256 d3f9c273b420be3ce59a8526d11827009215f559b39291844e3f98d8306c9a69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSI83F6.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI83F6.tmp
          • Size 349KB
          • SHA256 344abeb71ddccfdb70786849cca660982fd2ab099dcd74fd0d608a05139c8db1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ToDesk.msi
          • Path C:\Users\Admin\AppData\Roaming\Hainan YouQu Technology Co., Ltd\ToDesk 4.8.4.8\install\ToDesk.msi
          • Size 1.5MB
          • SHA256 5dead25512133ee8661c981be60e65f9d43fb39e88828416948b3358e213f23c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          default.dic
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-us\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          MSICE11.tmp
          • Path C:\Windows\Installer\MSICE11.tmp
          • Size 566KB
          • SHA256 675f7d999bf17ceedcd799bdf1b2fb02cc560cdc18c0609aa92eca0cd3a98961
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSICE9E.tmp
          • Path C:\Windows\Installer\MSICE9E.tmp
          • Size 287KB
          • SHA256 e12b2df53c66e4b3c5073682434fee7b1e070794f79e090ccc8fb803487f3a94
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 23.7MB
          • SHA256 4ba8e900a2a48f7bed1ce4d884bf0cfbeac0a6ea33a57f4fcab24dfc8e01a5b0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {ab24ec10-844e-4f51-8477-e6a282807f12}_OnDiskSnapshotProp
          • Path \??\Volume{fa3589b5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ab24ec10-844e-4f51-8477-e6a282807f12}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 a0d6bca6cbbef45ec261d27302bec4eed10b8c980073c36863be69fff6efa474
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/112-161-0x0000000000F90000-0x0000000000FCC000-memory.dmp
          Download

          memory/112-160-0x0000000000F90000-0x0000000000FCC000-memory.dmp
          Download

          memory/112-157-0x0000000000950000-0x0000000000951000-memory.dmp
          Download

          memory/112-145-0x0000000000F90000-0x0000000000FCC000-memory.dmp
          Download

          memory/112-147-0x0000000000F90000-0x0000000000FCC000-memory.dmp
          Download

          memory/112-159-0x0000000000F90000-0x0000000000FCC000-memory.dmp
          Download

          memory/112-158-0x0000000000F90000-0x0000000000FCC000-memory.dmp
          Download

          memory/556-188-0x00000000027A0000-0x00000000027DC000-memory.dmp
          Download

          memory/556-185-0x00000000010D0000-0x00000000010D1000-memory.dmp
          Download

          memory/556-184-0x00000000027A0000-0x00000000027DC000-memory.dmp
          Download

          memory/556-187-0x00000000027A0000-0x00000000027DC000-memory.dmp
          Download

          memory/556-186-0x00000000027A0000-0x00000000027DC000-memory.dmp
          Download

          memory/1232-174-0x0000000000EA0000-0x0000000000EDC000-memory.dmp
          Download

          memory/1232-127-0x0000000000EA0000-0x0000000000EDC000-memory.dmp
          Download

          memory/1464-162-0x0000000002870000-0x00000000028AC000-memory.dmp
          Download

          memory/1464-126-0x0000000002870000-0x00000000028AC000-memory.dmp
          Download

          memory/4296-146-0x0000000000E90000-0x0000000000ECC000-memory.dmp
          Download

          memory/4296-143-0x0000000000E90000-0x0000000000ECC000-memory.dmp
          Download