Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 16:17
General
-
Target
ToDesk_x64_4.7.4.8.exe
-
Size
56.3MB
-
MD5
e43eaf8183e538eb28e5dfd31ba074bc
-
SHA1
4d90bca79dbb3994fc1cf99921b1942520bee490
-
SHA256
3771d6a0594a42845193f182b177151b295e458f17749e74ae5a5320210a2fe8
-
SHA512
d43c32749ff1db235f063cc071c33af41dde25fd1c92d1fb670ad8ee0c5b7ab24f172138d7a18b0f61d9e4e959d4b765965ca3e38f0aa9cbb4e51125d6de70a5
-
SSDEEP
1572864:A4959RiO7XJ5d5crS8/JruPXzKgz5zejq4/OiV0xNnw:lT7XJ5gTJrOzKs5y//OiVwZw
Malware Config
Signatures
-
Detects PlugX payload 16 IoCs
-
PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 17 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 32 IoCs
-
Drops file in Windows directory 16 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 3 IoCs
-
Modifies registry class 25 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 45 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe"C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Hainan YouQu Technology Co., Ltd\ToDesk 4.8.4.8\install\ToDesk.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup "2⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 53F9EECE1D46B2E33DF0EB8A07E6897A C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 54B738E736509545F39AA4B82B4C2D6C C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2FCE0F33C1650901D93C1B0F06622EBD2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\ToDesk\Tools\wmicode.exe"C:\Program Files\ToDesk\Tools\wmicode.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 100 46043⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\ToDesk\ToDesk.exe"C:\Program Files\ToDesk\ToDesk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\ProgramData\NVIDIASmart\SxS.exe"C:\ProgramData\NVIDIASmart\SxS.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe 201 02⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 11323⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
-
-
C:\Program Files\ToDesk\ToDesk.exe"C:\Program Files\ToDesk\ToDesk.exe" --runservice1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\ToDesk\ToDesk.exe"C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=356002⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD5a611dcaa9c9478941eeb82b3ddaef5cb
SHA1d1e79d846920369b56b72b4c44f23585d2010512
SHA2561357d549c2fe6602afe62f9f987073741a2832a75ec4e17b42ac235e97ba94c6
SHA512a4c67ac745686cfdab59350f45e8747d301459055634cada972824451e81851948b51281e6f72badb81db08847e79c723bac20318f4beab15245172f6dd8a7c7
-
Filesize
48.4MB
MD585b8e15b90d8bf333f0d49c11db9b1b0
SHA170ab7088257b0121a8e39dcab2a3846923f62ac0
SHA256a9e56ee892beb3e0be3f2d412a2b4448c5a41b28fe2a15a40798faa119d4025c
SHA512844b924351752992758d881f328176f4329f8f9182ced686e51fa1fe3413b8ea3f507eac031b997b07b8886cb978655443bd6da1c018181f25ca73d4e035f64b
-
Filesize
122KB
MD5d771741bb33ab0f2f364fd10e486df33
SHA1fbb4d03ab6582627d341f76956fe995c182c98b1
SHA256d5d9fefd7a79ba0c121ba76d0cd51f9520effc490424978bd341f130ec835455
SHA51241f089d7ca755a385f68a65105e2aee0c9a34df03911746d59266db42bf3bf74372b168cebc40b034975ffe86dea93929e3a42155076bd8dcfbbefca78ba075e
-
Filesize
9KB
MD5cf23d084f48349158cb8f837a02369bd
SHA1bf2d8cee1ecbf85c29ab1ef4f157eebfb91f79e4
SHA256c9f2fd4ffc334d6e952b04b2d799714d034d6696dcff18c39f7e597ab9279451
SHA51248624f2e085dee127dc3499465ac1500d1daa8759e705af24a6f8dcfc417929a47ef973a62b79065312a2e5cda35819ef81c3fd98e62ea48c4db993943da545e
-
Filesize
130KB
MD5b1231c5483c4e1ac2e4832047364355d
SHA137b697dbee932d6cfc813ef91a8014c129df44e7
SHA25619795c19808560ea7f8595c77bf00f6db848479469ee9255bd80ee564e34867b
SHA512edee0b31b1b391baeba69bfec883de659a7aec9cf33c46d88dbbb389b9ebbf07ee4d4fcc8acd13ca611c8c16bdbd3b015834577f0b8f6dc55ab7315b6051df62
-
Filesize
98B
MD5c4b4aa073b5f34e3567df0cafd961c71
SHA1d5ac79f22bb2cba9376cb6fe6d6b6f2ec82b3daa
SHA256203d061be42c2f69be98ed463fbab09bffde98d6801aab65b64686d056529958
SHA5128c9cae6c5efd6f3bd30acbbc39c3bf36344d4c9ba63d07e12e8d7ecce6fc6e58b128d1d2248df4ef831131bf1fb7036afb3cddfe69be74e2df516e51b1702c41
-
Filesize
394B
MD52b635fe317895faa6f684a7b0b3c02ca
SHA116cf4d17a6309581dbb51c835819f0616e87414f
SHA2564790b60ab2b555432fdf226c5fd1c5ca8ee8d0762937cefac446b66423c96305
SHA512f7885febc0bb38c89200594727740cbd9f768146f664b336de89cb487c185a5036eeb6fe134bca6ffbc0a685123ff4ab3eb3036e1c80c998d88138d554d5e7fe
-
Filesize
529B
MD543044e81d88a4a1efd68bdb1786f291a
SHA16a09744be4737faa1801837cf10179774b3035cc
SHA2561cc7a4b24bf29d6a59dd9fe6f67c04289b457f85fcd2eb257ec56a976c00fe2b
SHA5126dcb1ed6d4ddc0091cd2c0dfee19f26201ab8e71946c327ae9d3e3d6dd1d884d34a60f0486cca4bda0c8729e9d1b6be5d01bb154f0b1954b4873cb77f8701863
-
Filesize
49.3MB
MD5fab94e3b080e8d2dfc21b37278f73eb8
SHA173c55c05f53b9ead97a4a6acd497860efc119ca8
SHA256d3f9c273b420be3ce59a8526d11827009215f559b39291844e3f98d8306c9a69
SHA51241eb4ddb54e2e8d3e21921c06a83aa0e59cd371eaeda0708cea27a1f42e05df6e5b4aa7f8cef4d6c3185ac71e48a405f2e44c972341a9961ab8e06f91ccc0f3a
-
Filesize
349KB
MD58752c01d76bc7b3a38b6acaf5b9c387b
SHA18c7b2b5ffdf3c46d2e9a5803f3b8ac20533e7778
SHA256344abeb71ddccfdb70786849cca660982fd2ab099dcd74fd0d608a05139c8db1
SHA5125a88de5be489088d8108dc45903e5d8368b53109c45646ab14ffe8fff41d5e3f5d19dc13ee1394dedb494e36f76824424602c8c65c6227741c952c2ffb7f4a0f
-
Filesize
1.5MB
MD5fd114784173437f9c5f462c62751fc63
SHA1a34e669da0342deb4c8fcbb27fb07bf604ee2a26
SHA256e7e55be0c02d71e4188782471402557e7bbbaab85cdd95dfd08aa5b16a49f6a2
SHA512086e63466761b326ff1749bffd11a1361c0171a62018e525ae35e7838b15db34b8df32e5abbe5e10f05926eb4ff221531d685c23a84aa4a56d565c178df8b845
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
566KB
MD50e4db22ddc7c96801b65bc13e3a53455
SHA1775da57600792fb18cd0e9626afc53bb2ba07abf
SHA256675f7d999bf17ceedcd799bdf1b2fb02cc560cdc18c0609aa92eca0cd3a98961
SHA51288ddb37880af878eddf7b82c919285dcec6360cea81c3755efeec7d0fb92c4e7ffe96ec654046ec9a4c6f1087d4e95b440b745621921041676bdc170663f3772
-
Filesize
287KB
MD531a4f044c23a648c306df463302c49b5
SHA1e014c21b4b0f3b054ee3f7b6bbba6b38974ab5da
SHA256e12b2df53c66e4b3c5073682434fee7b1e070794f79e090ccc8fb803487f3a94
SHA512e9d5606325a3e3fb371738bef66566f0491d080a5d6208482543f8729cd194d9dc11e3bc3989c3c19f359d3f34da977022b8a6457b6479ce5c51e3bf091a22fc
-
Filesize
23.7MB
MD5bcaaf9b8b51f9c8c6c3fdc541848852c
SHA12b95a9bb99a2d8611b29c9d7b789ab08ee619be9
SHA2563074dcc25791fd55daa5e0167fbf7ef30ee26fbd17d8c97a41f977257809bcc5
SHA512fe8fd0451bc84aae82aeaaff5fe9ec9138e3877a04f7e7884aa4c142813983c021dd2292ee3498ac91fda1ee790b2fee9dc86302f9c62961e3a7f255819e92d8
-
Filesize
6KB
MD5169f9e99828f548e1e08afea3a1bf7da
SHA1fe3e4ac45ca6a43fabcbb3509716e028cf8b54b4
SHA25612441056abb7a24b940285ecd7d5b6ad120f4851be6a1bf31c919d6fc9a84631
SHA512f175297d37ec791f07fc6d878bbea5c3de1a0feee34cad209e12461ce0b93ab528c401ec8a32030e0427c711f75543beba15da25a7eb4c91587235c24c5d886d
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
4KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB