plugx | 02cb95700440b100604ece78649b2ef41b2b7ea8ff68afbb02a01148a3f7c106

Resubmissions

30/12/2024, 19:51

241230-yk1f8awkfk10

20/09/2024, 23:58

240920-31bv1svgna10

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2024, 19:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll
Size 228KB
Sample241230-yk1f8awkfk
SHA256 66bca3f92841b7bffae4d27c3ddb5adbf8084ad40ee0edda1edc1d25f5e1b967
MD5 3c74a85c2cf883bd9d4b9f8b9746030f
SHA1 40541a03e910b21df681bec69cfe59678ebba86c
SHA512 15ab0c68e1dc8f5dc87231942f008228fe658ce221efe0ba90dfbfedea7e9cf401cac37098674a1d7cd489c97d061b847f09b86c24453575e2d46d4d9326e29c
SSDEEP 3072:Y3Bb2V38tdLIKbEN2HSKjZNPH4cGHk51Kk+u5arueqFl8sLbxDZxWRko5V:YRbvkKgN8/RH4hHk5gUUYFl8UmT
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

plugx discovery trojan

Malware Config

Signatures

Detects PlugX payload 21 IoCs

resource	yara_rule
behavioral10/memory/4408-15-0x00000000005D0000-0x0000000000600000-memory.dmp	family_plugx
behavioral10/memory/4920-34-0x0000000000690000-0x00000000006C0000-memory.dmp	family_plugx
behavioral10/memory/4776-37-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4920-38-0x0000000000690000-0x00000000006C0000-memory.dmp	family_plugx
behavioral10/memory/4408-39-0x00000000005D0000-0x0000000000600000-memory.dmp	family_plugx
behavioral10/memory/4776-51-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-52-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-53-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-40-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-54-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-55-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-56-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/5052-60-0x0000000000CE0000-0x0000000000D10000-memory.dmp	family_plugx
behavioral10/memory/5052-63-0x0000000000CE0000-0x0000000000D10000-memory.dmp	family_plugx
behavioral10/memory/5052-62-0x0000000000CE0000-0x0000000000D10000-memory.dmp	family_plugx
behavioral10/memory/4776-64-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-65-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-66-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-67-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-69-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx
behavioral10/memory/4776-71-0x0000000000CD0000-0x0000000000D00000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Plugx family
plugx

Executes dropped EXE 3 IoCs

pid	Process
364	C13D.tmp
4408	Gadget.exe
4920	Gadget.exe

Loads dropped DLL 2 IoCs

pid	Process
4408	Gadget.exe
4920	Gadget.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C13D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gadget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gadget.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 44004500430038003400350031003500370030004400350038003000310034000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4776	svchost.exe
4776	svchost.exe
4776	svchost.exe
4776	svchost.exe
4776	svchost.exe
4776	svchost.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
4776	svchost.exe
4776	svchost.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
4776	svchost.exe
4776	svchost.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
4776	svchost.exe
4776	svchost.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
4776	svchost.exe
4776	svchost.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe
5052	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4776	svchost.exe
5052	msiexec.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	Gadget.exe
Token: SeTcbPrivilege	4408	Gadget.exe
Token: SeDebugPrivilege	4920	Gadget.exe
Token: SeTcbPrivilege	4920	Gadget.exe
Token: SeDebugPrivilege	4776	svchost.exe
Token: SeTcbPrivilege	4776	svchost.exe
Token: SeDebugPrivilege	5052	msiexec.exe
Token: SeTcbPrivilege	5052	msiexec.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3652 wrote to memory of 760	3652	rundll32.exe	85
PID 3652 wrote to memory of 760	3652	rundll32.exe	85
PID 3652 wrote to memory of 760	3652	rundll32.exe	85
PID 760 wrote to memory of 364	760	rundll32.exe	86
PID 760 wrote to memory of 364	760	rundll32.exe	86
PID 760 wrote to memory of 364	760	rundll32.exe	86
PID 364 wrote to memory of 4408	364	C13D.tmp	87
PID 364 wrote to memory of 4408	364	C13D.tmp	87
PID 364 wrote to memory of 4408	364	C13D.tmp	87
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4920 wrote to memory of 4776	4920	Gadget.exe	93
PID 4776 wrote to memory of 5052	4776	svchost.exe	97
PID 4776 wrote to memory of 5052	4776	svchost.exe	97
PID 4776 wrote to memory of 5052	4776	svchost.exe	97
PID 4776 wrote to memory of 5052	4776	svchost.exe	97
PID 4776 wrote to memory of 5052	4776	svchost.exe	97
PID 4776 wrote to memory of 5052	4776	svchost.exe	97
PID 4776 wrote to memory of 5052	4776	svchost.exe	97
PID 4776 wrote to memory of 5052	4776	svchost.exe	97

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\PlugX_3C74A85C2CF883BD9D4B9F8B9746030F_DW20.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Users\Admin\AppData\Local\Temp\C13D.tmp
    C:\Users\Admin\AppData\Local\Temp\C13D.tmp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\Users\Admin\AppData\Local\Temp\Gadget.exe
      C:\Users\Admin\AppData\Local\Temp\\Gadget.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4408

C:\ProgramData\WS\Gadget.exe
C:\ProgramData\WS\Gadget.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4920
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 4776
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C13D.tmp

Path C:\Users\Admin\AppData\Local\Temp\C13D.tmp
Size 225KB
SHA256 90a5c1c5dc2278063478fbc8f2ac072ccf0489d7b3f81a6ed35b7d712b4b7b84
MD5 c116cd083284cc599c024c3479ca9b70
SHA1 bf831962162a0446454e3e32d764cc0e5daafde0
SHA512 d89ac7d971e46ee67f6857a71d3712205d28170320386a83d9cdbda97d270626cf2a0e91e0b866d368c65eb3e47766c20c07a2baeb51feb3fe7b8d98d848e560
SSDEEP 3072:hb2V38tdLIKbEN2HSKjZNPH4cGHk51Kk+u5arueqFl8sLbxDZxWRko5V:hbvkKgN8/RH4hHk5gUUYFl8UmT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Gadget.exe

Path C:\Users\Admin\AppData\Local\Temp\Gadget.exe
Size 25KB
SHA256 5c859ca16583d660449fb044677c128a9cdedd603d9598d4670235c52e359bf9
MD5 6b97b3cd2fcfb4b74985143230441463
SHA1 8985c2394ed9a58c36f907962b0724fe66c204a6
SHA512 736631b2ca37426c3915f496d5c3abdac23ffa91bd90fd8b215be2ad8735403ff9d58d1effe6791fa34a72141a5218f19808c0c4ece4100a525adbdeea4c1715
SSDEEP 192:HULB0P1oynsSW42fyu335/wJirNmL/8Qpkqs1Iu55+ebCfN54U6Gn:0Fa1GwK3mirILu1vPbCzvn
MD5 SHA1 SHA512 SSDEEP

Submit Download

SideBar.dll

Path C:\Users\Admin\AppData\Local\Temp\SideBar.dll
Size 41KB
SHA256 3144079c68ba00cebfd05239a2f5bd406096ec02e13e8571ca24313df7a5b679
MD5 901fa02ffd43de5b2d7c8c6b8c2f6a43
SHA1 8bb71adf1c418061510c40240852c3cd61fb214c
SHA512 6500b1a0e1a5995226bfcdaf1a33867bd9ccd5b84552db73f46dc1ee44461dbb29de6d16e8bf0da0c56d15ea60a4f44f105d005de139924ecb46d274cce90bab
SSDEEP 768:fQ+il+psGX0QEohGEVZ/E2G7k14rQMRkoIQ:fxiYVjE4VZ/ZWRkoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

SideBar.dll.doc

Path C:\Users\Admin\AppData\Local\Temp\SideBar.dll.doc
Size 121KB
SHA256 a13161d957ef1bf6362cbc488a82ffca8f6f52f48143f1110616b9c540e5997a
MD5 97c11e7d6b1926cd4be13804b36239ac
SHA1 b388b86a782ae14fee2a31bc7626a816c3eabc5a
SHA512 8ee3c39651b8d5790750436d04178e0d124c6573f1f773265349683635047a8f1adc34195f1a58001e96c57da3d3504a86026d3165a832117f10e9ebb233a121
SSDEEP 3072:HLIKbEN2HSKjZNPH4cGHk51Kk+u5arueqFl8sLT:HkKgN8/RH4hHk5gUUYFl8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4408-39-0x00000000005D0000-0x0000000000600000-memory.dmp

Download

memory/4408-12-0x0000000000401000-0x0000000000402000-memory.dmp

Download

memory/4408-15-0x00000000005D0000-0x0000000000600000-memory.dmp

Download

memory/4408-14-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4776-51-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-53-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-37-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-69-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-64-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-71-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-52-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-35-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/4776-50-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/4776-40-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-54-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-55-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-56-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-67-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-66-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4776-65-0x0000000000CD0000-0x0000000000D00000-memory.dmp

Download

memory/4920-34-0x0000000000690000-0x00000000006C0000-memory.dmp

Download

memory/4920-38-0x0000000000690000-0x00000000006C0000-memory.dmp

Download

memory/4920-32-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/5052-61-0x0000000000360000-0x0000000000361000-memory.dmp

Download

memory/5052-62-0x0000000000CE0000-0x0000000000D10000-memory.dmp

Download

memory/5052-63-0x0000000000CE0000-0x0000000000D10000-memory.dmp

Download

memory/5052-60-0x0000000000CE0000-0x0000000000D10000-memory.dmp

Download

memory/5052-59-0x0000000000360000-0x0000000000361000-memory.dmp

Download