Overview

overview

10

Static

static

3

ToDesk_x64....8.exe

windows7-x64

10

ToDesk_x64....8.exe

windows10-2004-x64

10

Resubmissions

30/12/2024, 19:54

241230-ymjw9ayme110

24/09/2024, 08:26

240924-kcchja1cla10

19/09/2024, 16:17

240919-trjptsybql10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2024, 16:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ToDesk_x64_4.7.4.8.exe
  • Size 56.3MB
  • Sample240919-trjptsybql
  • SHA256 3771d6a0594a42845193f182b177151b295e458f17749e74ae5a5320210a2fe8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
plugxdiscoverytrojan

Malware Config

Signatures

  • Detects PlugX payload 16 IoCs
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 17 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 16 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe
    "C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4488
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Hainan YouQu Technology Co., Ltd\ToDesk 4.8.4.8\install\ToDesk.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\ToDesk_x64_4.7.4.8.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup "
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      PID:4648
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5052
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 53F9EECE1D46B2E33DF0EB8A07E6897A C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1908
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 54B738E736509545F39AA4B82B4C2D6C C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:896
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:3812
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 2FCE0F33C1650901D93C1B0F06622EBD
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4912
      • C:\Program Files\ToDesk\Tools\wmicode.exe
        "C:\Program Files\ToDesk\Tools\wmicode.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4604
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe 100 4604
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:4452
      • C:\Program Files\ToDesk\ToDesk.exe
        "C:\Program Files\ToDesk\ToDesk.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:1332
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:4376
    • C:\ProgramData\NVIDIASmart\SxS.exe
      "C:\ProgramData\NVIDIASmart\SxS.exe" 200 0
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\SysWOW64\svchost.exe 201 0
        2⤵
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\SysWOW64\msiexec.exe
          C:\Windows\system32\msiexec.exe 209 1132
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          PID:1756
    • C:\Program Files\ToDesk\ToDesk.exe
      "C:\Program Files\ToDesk\ToDesk.exe" --runservice
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Program Files\ToDesk\ToDesk.exe
        "C:\Program Files\ToDesk\ToDesk.exe" --hide --localPort=35600
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:2520

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58246c.rbs
          • Path C:\Config.Msi\e58246c.rbs
          • Size 12KB
          • SHA256 1357d549c2fe6602afe62f9f987073741a2832a75ec4e17b42ac235e97ba94c6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ToDesk.exe
          • Path C:\Program Files\ToDesk\ToDesk.exe
          • Size 48.4MB
          • SHA256 a9e56ee892beb3e0be3f2d412a2b4448c5a41b28fe2a15a40798faa119d4025c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wmicode.exe
          • Path C:\Program Files\ToDesk\Tools\wmicode.exe
          • Size 122KB
          • SHA256 d5d9fefd7a79ba0c121ba76d0cd51f9520effc490424978bd341f130ec835455
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wmicodegen.dll
          • Path C:\Program Files\ToDesk\Tools\wmicodegen.dll
          • Size 9KB
          • SHA256 c9f2fd4ffc334d6e952b04b2d799714d034d6696dcff18c39f7e597ab9279451
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wmidll.dat
          • Path C:\Program Files\ToDesk\Tools\wmidll.dat
          • Size 130KB
          • SHA256 19795c19808560ea7f8595c77bf00f6db848479469ee9255bd80ee564e34867b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          config.ini
          • Path C:\Program Files\ToDesk\config.ini
          • Size 98B
          • SHA256 203d061be42c2f69be98ed463fbab09bffde98d6801aab65b64686d056529958
          • MD5 SHA1 SHA512
          Submit Download

          config.ini
          • Path C:\Program Files\ToDesk\config.ini
          • Size 394B
          • SHA256 4790b60ab2b555432fdf226c5fd1c5ca8ee8d0762937cefac446b66423c96305
          • MD5 SHA1 SHA512
          Submit Download

          config.ini
          • Path C:\Program Files\ToDesk\config.ini
          • Size 529B
          • SHA256 1cc7a4b24bf29d6a59dd9fe6f67c04289b457f85fcd2eb257ec56a976c00fe2b
          • MD5 SHA1 SHA512
          Submit Download

          zrtc.dll
          • Path C:\Program Files\ToDesk\zrtc.dll
          • Size 49.3MB
          • SHA256 d3f9c273b420be3ce59a8526d11827009215f559b39291844e3f98d8306c9a69
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSIA672.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSIA672.tmp
          • Size 349KB
          • SHA256 344abeb71ddccfdb70786849cca660982fd2ab099dcd74fd0d608a05139c8db1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          ToDesk.msi
          • Path C:\Users\Admin\AppData\Roaming\Hainan YouQu Technology Co., Ltd\ToDesk 4.8.4.8\install\ToDesk.msi
          • Size 1.5MB
          • SHA256 e7e55be0c02d71e4188782471402557e7bbbaab85cdd95dfd08aa5b16a49f6a2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          default.dic
          • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-us\default.dic
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          MSI26DF.tmp
          • Path C:\Windows\Installer\MSI26DF.tmp
          • Size 566KB
          • SHA256 675f7d999bf17ceedcd799bdf1b2fb02cc560cdc18c0609aa92eca0cd3a98961
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          MSI271F.tmp
          • Path C:\Windows\Installer\MSI271F.tmp
          • Size 287KB
          • SHA256 e12b2df53c66e4b3c5073682434fee7b1e070794f79e090ccc8fb803487f3a94
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 23.7MB
          • SHA256 3074dcc25791fd55daa5e0167fbf7ef30ee26fbd17d8c97a41f977257809bcc5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          {5e832a3c-2ac4-4c7d-ad77-3675de70431b}_OnDiskSnapshotProp
          • Path \??\Volume{f171a6e7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5e832a3c-2ac4-4c7d-ad77-3675de70431b}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 12441056abb7a24b940285ecd7d5b6ad120f4851be6a1bf31c919d6fc9a84631
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/1132-145-0x00000000018A0000-0x00000000018DA000-memory.dmp
          Download

          memory/1132-161-0x00000000018A0000-0x00000000018DA000-memory.dmp
          Download

          memory/1132-159-0x00000000018A0000-0x00000000018DA000-memory.dmp
          Download

          memory/1132-156-0x0000000001880000-0x0000000001881000-memory.dmp
          Download

          memory/1132-146-0x00000000018A0000-0x00000000018DA000-memory.dmp
          Download

          memory/1132-158-0x00000000018A0000-0x00000000018DA000-memory.dmp
          Download

          memory/1132-157-0x00000000018A0000-0x00000000018DA000-memory.dmp
          Download

          memory/1756-179-0x0000000000CD0000-0x0000000000D0A000-memory.dmp
          Download

          memory/1756-177-0x0000000000CD0000-0x0000000000D0A000-memory.dmp
          Download

          memory/1756-181-0x0000000000CD0000-0x0000000000D0A000-memory.dmp
          Download

          memory/1756-180-0x0000000000CD0000-0x0000000000D0A000-memory.dmp
          Download

          memory/1756-178-0x0000000000C60000-0x0000000000C61000-memory.dmp
          Download

          memory/1768-141-0x0000000001AE0000-0x0000000001B1A000-memory.dmp
          Download

          memory/1768-160-0x0000000001AE0000-0x0000000001B1A000-memory.dmp
          Download

          memory/4452-170-0x0000000000A00000-0x0000000000A3A000-memory.dmp
          Download

          memory/4452-127-0x0000000000A00000-0x0000000000A3A000-memory.dmp
          Download

          memory/4604-126-0x0000000001EE0000-0x0000000001F1A000-memory.dmp
          Download

          memory/4604-163-0x0000000001EE0000-0x0000000001F1A000-memory.dmp
          Download