Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-11-2024 01:01

General

  • Target

    adb.exe

  • Size

    804KB

  • MD5

    790fb1184a3ed8e475263daa54f98469

  • SHA1

    37a60f670a4f3c68a4872ec2e95c0be2bd130dae

  • SHA256

    ef4c7f4c417c18cd3394dd81ccd94381af252e0af81b0ad89b7e6d81412f4706

  • SHA512

    66a2325c59a7fdacd049f43b528224682245c2705f10c50a907b6454d5755522b9d9d07046426d42db8c324ba95adbde1de087e31a0fb21b635c1dc4ca25a4f8

  • SSDEEP

    12288:CMLitTtq+E3vEtR1PcUjB2ZuTvD5lnT7SQ22v9dzW74hGO2fVpUGpZdT3Rr8tz:CP5mC1P1jB2kv1xf9M4cThr8tz

Score
10/10

Malware Config

Signatures

  • Detects PlugX payload 22 IoCs
  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • Plugx family
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\adb.exe
    "C:\Users\Admin\AppData\Local\Temp\adb.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2784
  • C:\ProgramData\adb\adb.exe
    "C:\ProgramData\adb\adb.exe" 100 2784
    1⤵
    • Deletes itself
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:536
  • C:\ProgramData\adb\adb.exe
    "C:\ProgramData\adb\adb.exe" 200 0
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe 201 0
      2⤵
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2160
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\system32\msiexec.exe 209 2160
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\adb\AdbWinApi.dat

    Filesize

    148KB

    MD5

    cbcc0845497ddd773399e0f095539a4c

    SHA1

    6c878e4ee18d14b94a3214bdd283b221a1981877

    SHA256

    88045766007380b99fa7874c633d66bcb17d3314b6145ad5f8d8216e8e24b375

    SHA512

    e9a237e1ed9a53ce52c52ed40c43073430bc54b36996c53a90ab7524c0e3a3c9d8fa403b4f0ee52997f19d4d720f7d9db8efa7e988ca53efc221573a05a8e38f

  • C:\ProgramData\adb\AdbWinApi.dll

    Filesize

    39KB

    MD5

    ee5aca085318338c4d9ca42dae966b0c

    SHA1

    b47fef6dbb5982b4159533ee1dfecef6c285a262

    SHA256

    7050084c99d02f2e837207bff7a13a261d5435589771e9dc3f0db38841b97942

    SHA512

    3e8bedb69537cb0d809e63b8bad79b533d8ab2862d282d4ef331171331ce53aba8389886689c866ee3e5cf5568e17303d8c485e40914067c183aa729131255a0

  • C:\ProgramData\adb\adb.exe

    Filesize

    804KB

    MD5

    790fb1184a3ed8e475263daa54f98469

    SHA1

    37a60f670a4f3c68a4872ec2e95c0be2bd130dae

    SHA256

    ef4c7f4c417c18cd3394dd81ccd94381af252e0af81b0ad89b7e6d81412f4706

    SHA512

    66a2325c59a7fdacd049f43b528224682245c2705f10c50a907b6454d5755522b9d9d07046426d42db8c324ba95adbde1de087e31a0fb21b635c1dc4ca25a4f8

  • memory/536-20-0x00000000003A0000-0x00000000003D5000-memory.dmp

    Filesize

    212KB

  • memory/536-61-0x00000000003A0000-0x00000000003D5000-memory.dmp

    Filesize

    212KB

  • memory/2160-56-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-36-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-30-0x0000000000110000-0x0000000000112000-memory.dmp

    Filesize

    8KB

  • memory/2160-29-0x00000000000E0000-0x0000000000104000-memory.dmp

    Filesize

    144KB

  • memory/2160-27-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2160-31-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2160-32-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-57-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-76-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-48-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-50-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-59-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-55-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-47-0x00000000000C0000-0x00000000000C1000-memory.dmp

    Filesize

    4KB

  • memory/2160-51-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2160-53-0x0000000000240000-0x0000000000275000-memory.dmp

    Filesize

    212KB

  • memory/2628-46-0x0000000000520000-0x0000000000555000-memory.dmp

    Filesize

    212KB

  • memory/2628-35-0x0000000000400000-0x00000000004E1000-memory.dmp

    Filesize

    900KB

  • memory/2628-25-0x0000000000520000-0x0000000000555000-memory.dmp

    Filesize

    212KB

  • memory/2784-54-0x00000000003A0000-0x00000000003D5000-memory.dmp

    Filesize

    212KB

  • memory/2784-52-0x0000000000400000-0x00000000004E1000-memory.dmp

    Filesize

    900KB

  • memory/2784-0-0x0000000001F70000-0x0000000002070000-memory.dmp

    Filesize

    1024KB

  • memory/2784-1-0x00000000003A0000-0x00000000003D5000-memory.dmp

    Filesize

    212KB

  • memory/2932-70-0x00000000002A0000-0x00000000002D5000-memory.dmp

    Filesize

    212KB

  • memory/2932-74-0x00000000002A0000-0x00000000002D5000-memory.dmp

    Filesize

    212KB

  • memory/2932-75-0x00000000002A0000-0x00000000002D5000-memory.dmp

    Filesize

    212KB

  • memory/2932-73-0x00000000002A0000-0x00000000002D5000-memory.dmp

    Filesize

    212KB

  • memory/2932-72-0x00000000002A0000-0x00000000002D5000-memory.dmp

    Filesize

    212KB

  • memory/2932-71-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/2932-69-0x0000000000090000-0x0000000000091000-memory.dmp

    Filesize

    4KB