Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-11-2024 01:01
Static task
static1
Behavioral task
behavioral1
Sample
AdbWinApi.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
AdbWinApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
adb.exe
Resource
win7-20240903-en
General
-
Target
adb.exe
-
Size
804KB
-
MD5
790fb1184a3ed8e475263daa54f98469
-
SHA1
37a60f670a4f3c68a4872ec2e95c0be2bd130dae
-
SHA256
ef4c7f4c417c18cd3394dd81ccd94381af252e0af81b0ad89b7e6d81412f4706
-
SHA512
66a2325c59a7fdacd049f43b528224682245c2705f10c50a907b6454d5755522b9d9d07046426d42db8c324ba95adbde1de087e31a0fb21b635c1dc4ca25a4f8
-
SSDEEP
12288:CMLitTtq+E3vEtR1PcUjB2ZuTvD5lnT7SQ22v9dzW74hGO2fVpUGpZdT3Rr8tz:CP5mC1P1jB2kv1xf9M4cThr8tz
Malware Config
Signatures
-
Detects PlugX payload 22 IoCs
resource yara_rule behavioral3/memory/2784-1-0x00000000003A0000-0x00000000003D5000-memory.dmp family_plugx behavioral3/memory/536-20-0x00000000003A0000-0x00000000003D5000-memory.dmp family_plugx behavioral3/memory/2628-25-0x0000000000520000-0x0000000000555000-memory.dmp family_plugx behavioral3/memory/2160-32-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2160-36-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2628-46-0x0000000000520000-0x0000000000555000-memory.dmp family_plugx behavioral3/memory/2160-48-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2160-50-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2160-56-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2160-55-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2784-54-0x00000000003A0000-0x00000000003D5000-memory.dmp family_plugx behavioral3/memory/2160-53-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2160-57-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2160-51-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/2160-59-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx behavioral3/memory/536-61-0x00000000003A0000-0x00000000003D5000-memory.dmp family_plugx behavioral3/memory/2932-70-0x00000000002A0000-0x00000000002D5000-memory.dmp family_plugx behavioral3/memory/2932-74-0x00000000002A0000-0x00000000002D5000-memory.dmp family_plugx behavioral3/memory/2932-75-0x00000000002A0000-0x00000000002D5000-memory.dmp family_plugx behavioral3/memory/2932-73-0x00000000002A0000-0x00000000002D5000-memory.dmp family_plugx behavioral3/memory/2932-72-0x00000000002A0000-0x00000000002D5000-memory.dmp family_plugx behavioral3/memory/2160-76-0x0000000000240000-0x0000000000275000-memory.dmp family_plugx -
Plugx family
-
Deletes itself 1 IoCs
pid Process 536 adb.exe -
Executes dropped EXE 2 IoCs
pid Process 536 adb.exe 2628 adb.exe -
Loads dropped DLL 2 IoCs
pid Process 536 adb.exe 2628 adb.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 103.43.18.19 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\~MHZ svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0 svchost.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST svchost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 33003700420045004300360034003700410046003800360032004200350042000000 svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2160 svchost.exe 2160 svchost.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2160 svchost.exe 2160 svchost.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2160 svchost.exe 2160 svchost.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2160 svchost.exe 2160 svchost.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2932 msiexec.exe 2160 svchost.exe 2160 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2160 svchost.exe 2932 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2784 adb.exe Token: SeTcbPrivilege 2784 adb.exe Token: SeDebugPrivilege 536 adb.exe Token: SeTcbPrivilege 536 adb.exe Token: SeDebugPrivilege 2628 adb.exe Token: SeTcbPrivilege 2628 adb.exe Token: SeDebugPrivilege 2160 svchost.exe Token: SeTcbPrivilege 2160 svchost.exe Token: SeDebugPrivilege 2932 msiexec.exe Token: SeTcbPrivilege 2932 msiexec.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2628 wrote to memory of 2160 2628 adb.exe 35 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36 PID 2160 wrote to memory of 2932 2160 svchost.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\adb.exe"C:\Users\Admin\AppData\Local\Temp\adb.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
C:\ProgramData\adb\adb.exe"C:\ProgramData\adb\adb.exe" 100 27841⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:536
-
C:\ProgramData\adb\adb.exe"C:\ProgramData\adb\adb.exe" 200 01⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 201 02⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 21603⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2932
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
148KB
MD5cbcc0845497ddd773399e0f095539a4c
SHA16c878e4ee18d14b94a3214bdd283b221a1981877
SHA25688045766007380b99fa7874c633d66bcb17d3314b6145ad5f8d8216e8e24b375
SHA512e9a237e1ed9a53ce52c52ed40c43073430bc54b36996c53a90ab7524c0e3a3c9d8fa403b4f0ee52997f19d4d720f7d9db8efa7e988ca53efc221573a05a8e38f
-
Filesize
39KB
MD5ee5aca085318338c4d9ca42dae966b0c
SHA1b47fef6dbb5982b4159533ee1dfecef6c285a262
SHA2567050084c99d02f2e837207bff7a13a261d5435589771e9dc3f0db38841b97942
SHA5123e8bedb69537cb0d809e63b8bad79b533d8ab2862d282d4ef331171331ce53aba8389886689c866ee3e5cf5568e17303d8c485e40914067c183aa729131255a0
-
Filesize
804KB
MD5790fb1184a3ed8e475263daa54f98469
SHA137a60f670a4f3c68a4872ec2e95c0be2bd130dae
SHA256ef4c7f4c417c18cd3394dd81ccd94381af252e0af81b0ad89b7e6d81412f4706
SHA51266a2325c59a7fdacd049f43b528224682245c2705f10c50a907b6454d5755522b9d9d07046426d42db8c324ba95adbde1de087e31a0fb21b635c1dc4ca25a4f8