plugx | e893dbe6b911e8faea85dad69061e2755ef52db23bc5163f7c5dfd4138f29d6e

General

Target

wps.exe
Size

177KB
MD5

f44992d14033a2b5b1064104658a29e1
SHA1

62673aa6e8bde17f218524cbe3bf50cb5b949f3b
SHA256

331f64d6d6bf7883ed8a3c29ab8ce3bf947aaecf49748a7a2b5113ced68607a4
SHA512

9a57d5765e9dcff8caccf8b51449bfd8d35f9c346c9a09a5c64a7229136490bc1cb5a3f07c8d9c75aaf48e16e01700c3d6674fc1b8d170ce927913c4130bc31b
SSDEEP

3072:65nSsRkXPsSadfviPNPVY5bYm1wkUBL/1cAR+oOb5vENb/fZOKeb0WhmNNdnLeny:65SsRkXPYGPG5cm6Bd3oEt/fZOaBi/fi

Score

10^/10

plugx trojan vmprotect

Malware Config

Signatures

Detects PlugX payload 19 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1580-4-0x0000000001B90000-0x0000000001BCA000-memory.dmp	family_plugx
behavioral3/memory/1580-5-0x0000000001B90000-0x0000000001BCA000-memory.dmp	family_plugx
behavioral3/memory/2708-27-0x0000000001D70000-0x0000000001DAA000-memory.dmp	family_plugx
behavioral3/memory/2704-37-0x0000000001CC0000-0x0000000001CFA000-memory.dmp	family_plugx
behavioral3/memory/2712-44-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2704-47-0x0000000001CC0000-0x0000000001CFA000-memory.dmp	family_plugx
behavioral3/memory/2712-48-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2712-65-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2712-63-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2712-62-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2712-61-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2712-60-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2712-66-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx
behavioral3/memory/2708-70-0x0000000001D70000-0x0000000001DAA000-memory.dmp	family_plugx
behavioral3/memory/2552-85-0x0000000000550000-0x000000000058A000-memory.dmp	family_plugx
behavioral3/memory/2552-86-0x0000000000550000-0x000000000058A000-memory.dmp	family_plugx
behavioral3/memory/2552-84-0x0000000000550000-0x000000000058A000-memory.dmp	family_plugx
behavioral3/memory/2552-81-0x0000000000550000-0x000000000058A000-memory.dmp	family_plugx
behavioral3/memory/2712-87-0x00000000003E0000-0x000000000041A000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Plugx family
plugx
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 103.43.18.19

description	ioc
Destination IP	103.43.18.19

VMProtect packed file 9 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral3/memory/1580-0-0x000007FEF8040000-0x000007FEF8084000-memory.dmp	vmprotect
behavioral3/memory/1580-1-0x000007FEF8040000-0x000007FEF8084000-memory.dmp	vmprotect
behavioral3/memory/2708-24-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp	vmprotect
\ProgramData\Kingsoft\office6\kdump64.dll	vmprotect
behavioral3/memory/2704-33-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp	vmprotect
behavioral3/memory/2704-34-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp	vmprotect
behavioral3/memory/1580-36-0x000007FEF8040000-0x000007FEF8084000-memory.dmp	vmprotect
behavioral3/memory/2704-53-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp	vmprotect
behavioral3/memory/2708-71-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp	vmprotect

Deletes itself 1 IoCs

Processes:

wps.exe

pid process

2708 wps.exe
Executes dropped EXE 3 IoCs

Processes:

wps.exewps.exe

pid process

2708 wps.exe
476
2704 wps.exe
Loads dropped DLL 5 IoCs

Processes:

wps.exewps.exe

pid process

2724
2724
2708 wps.exe
476
2704 wps.exe

pid	process
2708	wps.exe

pid	process
2708	wps.exe
476
2704	wps.exe

pid	process
2724
2724
2708	wps.exe
476
2704	wps.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\~MHZ	svchost.exe

Modifies registry class 2 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 45003700430045004600360036003400410034003400440044004100460034000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

wps.exewps.exewps.exesvchost.exemsiexec.exe

pid	process
1580	wps.exe
1580	wps.exe
2708	wps.exe
2708	wps.exe
2704	wps.exe
2704	wps.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2712	svchost.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2712	svchost.exe
2712	svchost.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2712	svchost.exe
2712	svchost.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2712	svchost.exe
2712	svchost.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2712	svchost.exe
2712	svchost.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe
2552	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

svchost.exemsiexec.exe

pid process

2712 svchost.exe
2552 msiexec.exe

pid	process
2712	svchost.exe
2552	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

wps.exewps.exewps.exesvchost.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1580	wps.exe
Token: SeTcbPrivilege	1580	wps.exe
Token: SeDebugPrivilege	2708	wps.exe
Token: SeTcbPrivilege	2708	wps.exe
Token: SeDebugPrivilege	2704	wps.exe
Token: SeTcbPrivilege	2704	wps.exe
Token: SeDebugPrivilege	2712	svchost.exe
Token: SeTcbPrivilege	2712	svchost.exe
Token: SeDebugPrivilege	2552	msiexec.exe
Token: SeTcbPrivilege	2552	msiexec.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

wps.exesvchost.exe

description	pid	process	target process
PID 2704 wrote to memory of 2712	2704	wps.exe	svchost.exe
PID 2704 wrote to memory of 2712	2704	wps.exe	svchost.exe
PID 2704 wrote to memory of 2712	2704	wps.exe	svchost.exe
PID 2704 wrote to memory of 2712	2704	wps.exe	svchost.exe
PID 2704 wrote to memory of 2712	2704	wps.exe	svchost.exe
PID 2704 wrote to memory of 2712	2704	wps.exe	svchost.exe
PID 2704 wrote to memory of 2712	2704	wps.exe	svchost.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe
PID 2712 wrote to memory of 2552	2712	svchost.exe	msiexec.exe

C:\Users\Admin\AppData\Local\Temp\wps.exe
"C:\Users\Admin\AppData\Local\Temp\wps.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\ProgramData\Kingsoft\office6\wps.exe
"C:\ProgramData\Kingsoft\office6\wps.exe" 100 1580
1⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2708

C:\ProgramData\Kingsoft\office6\wps.exe
"C:\ProgramData\Kingsoft\office6\wps.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 2712
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Kingsoft\office6\wps.dat

Filesize
152KB

MD5
a1ed676cf36394b6b4fb449309b91b5b

SHA1
4cf7a01b132e4855581e39f5d0da204301fdae98

SHA256
8da2085b60e44aa5fa46c8613757e1582df098e27373b2c8916d2725f28b46de

SHA512
ce224d2376a7d78777691f9eceb8a48755787b390b73e309d48337b8d097a9370e66780237e2884294c76205f93f27e82744804781abe8eaee255c9e2f0f3f11

Download Submit
\ProgramData\Kingsoft\office6\kdump64.dll

Filesize
148KB

MD5
d5dcfc5ac42bcba55a1170756f3493f4

SHA1
1bcefa919e0c9c1d114ed6384e4aff8f316482de

SHA256
8ba00843b9aba2cff6f2234a7daf040aadfebce4c05b13061da63b48f63bfa4f

SHA512
dbaf78188b53629d667bdcb4fcdc0c35045e77330bbe209739c86fbe2d7c2ba04b3adeedc6576186e1af20f8eb373a9788ed3b0050f80f61485475dcf23b0a24

Download Submit
\ProgramData\Kingsoft\office6\wps.exe

Filesize
177KB

MD5
f44992d14033a2b5b1064104658a29e1

SHA1
62673aa6e8bde17f218524cbe3bf50cb5b949f3b

SHA256
331f64d6d6bf7883ed8a3c29ab8ce3bf947aaecf49748a7a2b5113ced68607a4

SHA512
9a57d5765e9dcff8caccf8b51449bfd8d35f9c346c9a09a5c64a7229136490bc1cb5a3f07c8d9c75aaf48e16e01700c3d6674fc1b8d170ce927913c4130bc31b

Download Submit
memory/1580-0-0x000007FEF8040000-0x000007FEF8084000-memory.dmp

Filesize
272KB

Download
memory/1580-36-0x000007FEF8040000-0x000007FEF8084000-memory.dmp

Filesize
272KB

Download
memory/1580-5-0x0000000001B90000-0x0000000001BCA000-memory.dmp

Filesize
232KB

Download
memory/1580-3-0x0000000002070000-0x0000000002170000-memory.dmp

Filesize
1024KB

Download
memory/1580-1-0x000007FEF8040000-0x000007FEF8084000-memory.dmp

Filesize
272KB

Download
memory/1580-2-0x0000000077140000-0x0000000077141000-memory.dmp

Filesize
4KB

Download
memory/1580-4-0x0000000001B90000-0x0000000001BCA000-memory.dmp

Filesize
232KB

Download
memory/2552-85-0x0000000000550000-0x000000000058A000-memory.dmp

Filesize
232KB

Download
memory/2552-86-0x0000000000550000-0x000000000058A000-memory.dmp

Filesize
232KB

Download
memory/2552-84-0x0000000000550000-0x000000000058A000-memory.dmp

Filesize
232KB

Download
memory/2552-83-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2552-81-0x0000000000550000-0x000000000058A000-memory.dmp

Filesize
232KB

Download
memory/2704-37-0x0000000001CC0000-0x0000000001CFA000-memory.dmp

Filesize
232KB

Download
memory/2704-34-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp

Filesize
272KB

Download
memory/2704-33-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp

Filesize
272KB

Download
memory/2704-47-0x0000000001CC0000-0x0000000001CFA000-memory.dmp

Filesize
232KB

Download
memory/2704-53-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp

Filesize
272KB

Download
memory/2708-70-0x0000000001D70000-0x0000000001DAA000-memory.dmp

Filesize
232KB

Download
memory/2708-28-0x0000000077140000-0x0000000077141000-memory.dmp

Filesize
4KB

Download
memory/2708-27-0x0000000001D70000-0x0000000001DAA000-memory.dmp

Filesize
232KB

Download
memory/2708-24-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp

Filesize
272KB

Download
memory/2708-71-0x000007FEF7F30000-0x000007FEF7F74000-memory.dmp

Filesize
272KB

Download
memory/2712-43-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2712-62-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-61-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-60-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-59-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2712-66-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-63-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-65-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-48-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-44-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download
memory/2712-42-0x00000000000B0000-0x00000000000B2000-memory.dmp

Filesize
8KB

Download
memory/2712-39-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2712-41-0x0000000000080000-0x00000000000A5000-memory.dmp

Filesize
148KB

Download
memory/2712-87-0x00000000003E0000-0x000000000041A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads