plugx | e893dbe6b911e8faea85dad69061e2755ef52db23bc5163f7c5dfd4138f29d6e

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-12-2024 17:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

wps.exe
Size

177KB
MD5

f44992d14033a2b5b1064104658a29e1
SHA1

62673aa6e8bde17f218524cbe3bf50cb5b949f3b
SHA256

331f64d6d6bf7883ed8a3c29ab8ce3bf947aaecf49748a7a2b5113ced68607a4
SHA512

9a57d5765e9dcff8caccf8b51449bfd8d35f9c346c9a09a5c64a7229136490bc1cb5a3f07c8d9c75aaf48e16e01700c3d6674fc1b8d170ce927913c4130bc31b
SSDEEP

3072:65nSsRkXPsSadfviPNPVY5bYm1wkUBL/1cAR+oOb5vENb/fZOKeb0WhmNNdnLeny:65SsRkXPYGPG5cm6Bd3oEt/fZOaBi/fi

Score

10^/10

plugx trojan vmprotect

Malware Config

Signatures

Detects PlugX payload 23 IoCs

resource	yara_rule
behavioral4/memory/4188-4-0x0000000000910000-0x000000000094A000-memory.dmp	family_plugx
behavioral4/memory/4188-5-0x0000000000910000-0x000000000094A000-memory.dmp	family_plugx
behavioral4/memory/4064-27-0x0000000001F70000-0x0000000001FAA000-memory.dmp	family_plugx
behavioral4/memory/4064-28-0x0000000001F70000-0x0000000001FAA000-memory.dmp	family_plugx
behavioral4/memory/3816-37-0x0000000000F50000-0x0000000000F8A000-memory.dmp	family_plugx
behavioral4/memory/3816-41-0x0000000000F50000-0x0000000000F8A000-memory.dmp	family_plugx
behavioral4/memory/2696-55-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-61-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-62-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-60-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/4188-66-0x0000000000910000-0x000000000094A000-memory.dmp	family_plugx
behavioral4/memory/2696-58-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-57-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-54-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-53-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-42-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/2696-39-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx
behavioral4/memory/4064-67-0x0000000001F70000-0x0000000001FAA000-memory.dmp	family_plugx
behavioral4/memory/3212-70-0x00000283CA140000-0x00000283CA17A000-memory.dmp	family_plugx
behavioral4/memory/3212-73-0x00000283CA140000-0x00000283CA17A000-memory.dmp	family_plugx
behavioral4/memory/3212-75-0x00000283CA140000-0x00000283CA17A000-memory.dmp	family_plugx
behavioral4/memory/3212-74-0x00000283CA140000-0x00000283CA17A000-memory.dmp	family_plugx
behavioral4/memory/2696-76-0x0000021671C70000-0x0000021671CAA000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Plugx family
plugx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	103.43.18.19

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral4/memory/4188-0-0x00007FFA9DA50000-0x00007FFA9DA94000-memory.dmp	vmprotect
behavioral4/memory/4188-1-0x00007FFA9DA50000-0x00007FFA9DA94000-memory.dmp	vmprotect
behavioral4/files/0x000a000000023b95-21.dat	vmprotect
behavioral4/memory/4064-23-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp	vmprotect
behavioral4/memory/4064-22-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp	vmprotect
behavioral4/memory/3816-31-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp	vmprotect
behavioral4/memory/3816-32-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp	vmprotect
behavioral4/memory/3816-59-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp	vmprotect
behavioral4/memory/4188-35-0x00007FFA9DA50000-0x00007FFA9DA94000-memory.dmp	vmprotect
behavioral4/memory/4064-68-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp	vmprotect

Deletes itself 1 IoCs

pid	Process
4064	wps.exe

Executes dropped EXE 2 IoCs

pid	Process
4064	wps.exe
3816	wps.exe

Loads dropped DLL 2 IoCs

pid	Process
4064	wps.exe
3816	wps.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHZ	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 34003000340033003300320046003700450030003400370037003900360034000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4188	wps.exe
4188	wps.exe
4188	wps.exe
4188	wps.exe
4064	wps.exe
4064	wps.exe
4064	wps.exe
4064	wps.exe
3816	wps.exe
3816	wps.exe
3816	wps.exe
3816	wps.exe
2696	svchost.exe
2696	svchost.exe
2696	svchost.exe
2696	svchost.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
2696	svchost.exe
2696	svchost.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
2696	svchost.exe
2696	svchost.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
2696	svchost.exe
2696	svchost.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
3212	msiexec.exe
2696	svchost.exe
2696	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2696	svchost.exe
3212	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4188	wps.exe
Token: SeTcbPrivilege	4188	wps.exe
Token: SeDebugPrivilege	4064	wps.exe
Token: SeTcbPrivilege	4064	wps.exe
Token: SeDebugPrivilege	3816	wps.exe
Token: SeTcbPrivilege	3816	wps.exe
Token: SeDebugPrivilege	2696	svchost.exe
Token: SeTcbPrivilege	2696	svchost.exe
Token: SeDebugPrivilege	3212	msiexec.exe
Token: SeTcbPrivilege	3212	msiexec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 2696	3816	wps.exe	85
PID 3816 wrote to memory of 2696	3816	wps.exe	85
PID 3816 wrote to memory of 2696	3816	wps.exe	85
PID 3816 wrote to memory of 2696	3816	wps.exe	85
PID 3816 wrote to memory of 2696	3816	wps.exe	85
PID 3816 wrote to memory of 2696	3816	wps.exe	85
PID 2696 wrote to memory of 3212	2696	svchost.exe	86
PID 2696 wrote to memory of 3212	2696	svchost.exe	86
PID 2696 wrote to memory of 3212	2696	svchost.exe	86
PID 2696 wrote to memory of 3212	2696	svchost.exe	86
PID 2696 wrote to memory of 3212	2696	svchost.exe	86
PID 2696 wrote to memory of 3212	2696	svchost.exe	86

C:\Users\Admin\AppData\Local\Temp\wps.exe
"C:\Users\Admin\AppData\Local\Temp\wps.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\ProgramData\Kingsoft\office6\wps.exe
"C:\ProgramData\Kingsoft\office6\wps.exe" 100 4188
1⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4064

C:\ProgramData\Kingsoft\office6\wps.exe
"C:\ProgramData\Kingsoft\office6\wps.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 2696
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Kingsoft\office6\kdump64.dll

Filesize
148KB

MD5
d5dcfc5ac42bcba55a1170756f3493f4

SHA1
1bcefa919e0c9c1d114ed6384e4aff8f316482de

SHA256
8ba00843b9aba2cff6f2234a7daf040aadfebce4c05b13061da63b48f63bfa4f

SHA512
dbaf78188b53629d667bdcb4fcdc0c35045e77330bbe209739c86fbe2d7c2ba04b3adeedc6576186e1af20f8eb373a9788ed3b0050f80f61485475dcf23b0a24

Download Submit
C:\ProgramData\Kingsoft\office6\wps.dat

Filesize
152KB

MD5
a1ed676cf36394b6b4fb449309b91b5b

SHA1
4cf7a01b132e4855581e39f5d0da204301fdae98

SHA256
8da2085b60e44aa5fa46c8613757e1582df098e27373b2c8916d2725f28b46de

SHA512
ce224d2376a7d78777691f9eceb8a48755787b390b73e309d48337b8d097a9370e66780237e2884294c76205f93f27e82744804781abe8eaee255c9e2f0f3f11

Download Submit
C:\ProgramData\Kingsoft\office6\wps.exe

Filesize
177KB

MD5
f44992d14033a2b5b1064104658a29e1

SHA1
62673aa6e8bde17f218524cbe3bf50cb5b949f3b

SHA256
331f64d6d6bf7883ed8a3c29ab8ce3bf947aaecf49748a7a2b5113ced68607a4

SHA512
9a57d5765e9dcff8caccf8b51449bfd8d35f9c346c9a09a5c64a7229136490bc1cb5a3f07c8d9c75aaf48e16e01700c3d6674fc1b8d170ce927913c4130bc31b

Download Submit
memory/2696-42-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-55-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-76-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-62-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-60-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-39-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-53-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-54-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-56-0x00000216718A0000-0x00000216718A1000-memory.dmp

Filesize
4KB

Download
memory/2696-57-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-58-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/2696-38-0x00000216718A0000-0x00000216718A1000-memory.dmp

Filesize
4KB

Download
memory/2696-61-0x0000021671C70000-0x0000021671CAA000-memory.dmp

Filesize
232KB

Download
memory/3212-70-0x00000283CA140000-0x00000283CA17A000-memory.dmp

Filesize
232KB

Download
memory/3212-75-0x00000283CA140000-0x00000283CA17A000-memory.dmp

Filesize
232KB

Download
memory/3212-74-0x00000283CA140000-0x00000283CA17A000-memory.dmp

Filesize
232KB

Download
memory/3212-72-0x00000283C8620000-0x00000283C8621000-memory.dmp

Filesize
4KB

Download
memory/3212-73-0x00000283CA140000-0x00000283CA17A000-memory.dmp

Filesize
232KB

Download
memory/3816-37-0x0000000000F50000-0x0000000000F8A000-memory.dmp

Filesize
232KB

Download
memory/3816-41-0x0000000000F50000-0x0000000000F8A000-memory.dmp

Filesize
232KB

Download
memory/3816-32-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp

Filesize
272KB

Download
memory/3816-31-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp

Filesize
272KB

Download
memory/3816-59-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp

Filesize
272KB

Download
memory/3816-34-0x00007FFAA6AC0000-0x00007FFAA6AC1000-memory.dmp

Filesize
4KB

Download
memory/4064-22-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp

Filesize
272KB

Download
memory/4064-67-0x0000000001F70000-0x0000000001FAA000-memory.dmp

Filesize
232KB

Download
memory/4064-28-0x0000000001F70000-0x0000000001FAA000-memory.dmp

Filesize
232KB

Download
memory/4064-68-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp

Filesize
272KB

Download
memory/4064-23-0x00007FFA9A0D0000-0x00007FFA9A114000-memory.dmp

Filesize
272KB

Download
memory/4064-25-0x00007FFAA6A90000-0x00007FFAA6A91000-memory.dmp

Filesize
4KB

Download
memory/4064-27-0x0000000001F70000-0x0000000001FAA000-memory.dmp

Filesize
232KB

Download
memory/4188-35-0x00007FFA9DA50000-0x00007FFA9DA94000-memory.dmp

Filesize
272KB

Download
memory/4188-0-0x00007FFA9DA50000-0x00007FFA9DA94000-memory.dmp

Filesize
272KB

Download
memory/4188-2-0x00007FFAA6A90000-0x00007FFAA6A91000-memory.dmp

Filesize
4KB

Download
memory/4188-1-0x00007FFA9DA50000-0x00007FFA9DA94000-memory.dmp

Filesize
272KB

Download
memory/4188-4-0x0000000000910000-0x000000000094A000-memory.dmp

Filesize
232KB

Download
memory/4188-66-0x0000000000910000-0x000000000094A000-memory.dmp

Filesize
232KB

Download
memory/4188-3-0x0000000002310000-0x0000000002410000-memory.dmp

Filesize
1024KB

Download
memory/4188-5-0x0000000000910000-0x000000000094A000-memory.dmp

Filesize
232KB

Download