plugx | 7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe
Size

554KB
MD5

9310477537d5d7c92bc711547a4c9621
SHA1

5b90d064de8955cf26ac9c1e59a60c106871aa79
SHA256

7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f
SHA512

31b3367c2736e4549bfe7a7511c76ced47f14faf2200439e973f1b7c96dacb90412bad4bf3467e9d8e2b3b38367a674075360940d5749a5e697bb92e4ecd5707
SSDEEP

12288:YUomEFRu3xEPE6HuRurMRFs7hm7p0fdINC//TZSIy:YmOMSPE6ORIMPT0fdIkHTZSR

Score

10^/10

plugx discovery trojan

Malware Config

Signatures

Detects PlugX payload 21 IoCs

resource	yara_rule
behavioral1/memory/1708-26-0x0000000000370000-0x00000000003A5000-memory.dmp	family_plugx
behavioral1/memory/2684-48-0x00000000001C0000-0x00000000001F5000-memory.dmp	family_plugx
behavioral1/memory/3008-54-0x00000000002E0000-0x0000000000315000-memory.dmp	family_plugx
behavioral1/memory/2928-60-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-76-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-79-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-73-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-78-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/1708-77-0x0000000000370000-0x00000000003A5000-memory.dmp	family_plugx
behavioral1/memory/2928-75-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-74-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-80-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-81-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/2928-62-0x0000000000270000-0x00000000002A5000-memory.dmp	family_plugx
behavioral1/memory/3008-61-0x00000000002E0000-0x0000000000315000-memory.dmp	family_plugx
behavioral1/memory/2684-84-0x00000000001C0000-0x00000000001F5000-memory.dmp	family_plugx
behavioral1/memory/1656-90-0x00000000006A0000-0x00000000006D5000-memory.dmp	family_plugx
behavioral1/memory/1656-94-0x00000000006A0000-0x00000000006D5000-memory.dmp	family_plugx
behavioral1/memory/1656-95-0x00000000006A0000-0x00000000006D5000-memory.dmp	family_plugx
behavioral1/memory/1656-93-0x00000000006A0000-0x00000000006D5000-memory.dmp	family_plugx
behavioral1/memory/1656-92-0x00000000006A0000-0x00000000006D5000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Plugx family
plugx

Executes dropped EXE 3 IoCs

pid	Process
1708	SoftManager.exe
2684	SoftManager.exe
3008	SoftManager.exe

Loads dropped DLL 13 IoCs

pid	Process
2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe
2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe
2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe
2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe
1708	SoftManager.exe
1708	SoftManager.exe
1708	SoftManager.exe
2684	SoftManager.exe
2684	SoftManager.exe
2684	SoftManager.exe
3008	SoftManager.exe
3008	SoftManager.exe
3008	SoftManager.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	100.110.162.133
Destination IP	100.82.92.41
Destination IP	100.103.84.57
Destination IP	100.107.185.138

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SoftManager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 38003400460046004600390042003300390032003100350032003500380037000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2928	svchost.exe
2928	svchost.exe
2928	svchost.exe
2928	svchost.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
2928	svchost.exe
2928	svchost.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
2928	svchost.exe
2928	svchost.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
2928	svchost.exe
2928	svchost.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
2928	svchost.exe
2928	svchost.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
1656	msiexec.exe
2928	svchost.exe
2928	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2928	svchost.exe
1656	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	1708	SoftManager.exe
Token: SeTcbPrivilege	1708	SoftManager.exe
Token: SeDebugPrivilege	2684	SoftManager.exe
Token: SeTcbPrivilege	2684	SoftManager.exe
Token: SeDebugPrivilege	3008	SoftManager.exe
Token: SeTcbPrivilege	3008	SoftManager.exe
Token: SeDebugPrivilege	2928	svchost.exe
Token: SeTcbPrivilege	2928	svchost.exe
Token: SeDebugPrivilege	1656	msiexec.exe
Token: SeTcbPrivilege	1656	msiexec.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1708	2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe	30
PID 2404 wrote to memory of 1708	2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe	30
PID 2404 wrote to memory of 1708	2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe	30
PID 2404 wrote to memory of 1708	2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe	30
PID 2404 wrote to memory of 1708	2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe	30
PID 2404 wrote to memory of 1708	2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe	30
PID 2404 wrote to memory of 1708	2404	7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe	30
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 3008 wrote to memory of 2928	3008	SoftManager.exe	34
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36
PID 2928 wrote to memory of 1656	2928	svchost.exe	36

C:\Users\Admin\AppData\Local\Temp\7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe
"C:\Users\Admin\AppData\Local\Temp\7d0ff5125ace6fc49103c71fdab7f430c20741ce36b54e0379c71a6841962e0f.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Users\Admin\AppData\Local\Temp\SoftManager.exe
  "C:\Users\Admin\AppData\Local\Temp\SoftManager.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1708

C:\ProgramData\360SoftManager\softmgr\SoftManager.exe
"C:\ProgramData\360SoftManager\softmgr\SoftManager.exe" 100 1708
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\ProgramData\360SoftManager\softmgr\SoftManager.exe
"C:\ProgramData\360SoftManager\softmgr\SoftManager.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 2928
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SoftManager.dat

Filesize
148KB

MD5
e46f18ec2a13ef883c1b6a50ec157971

SHA1
816e48a51827797bf3ab2204b962ab1edcb018d6

SHA256
31ba90be019b15895da9b3a0943e88115fc08769d7857fc2fedc6eb7b13fd9c9

SHA512
6c9da9296390c050af8255f1dead0bc18835bc5dbe2fd0e2baa6d00ed5c58b5109f06b4edd76e826b1976ce513cb0c097243ce5812f17b6be518469b10e35b0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\dbghelp.dll

Filesize
33KB

MD5
ce07ef4ef68a65715bb2c2beabdd289e

SHA1
bc9565fc5b790cb6e6c7097248a3f4063db33ce6

SHA256
ddd19d60f37f04e33fb74f6ef2e45f24be1bab8423aba608987804eed9316567

SHA512
d24023ac21524e5e9d7d885c65038533ef055a9ada45a0a6f5b8218a88328dec27ea83fbff0423daf331b038da4fae2df3b450e3bfe41882b29e57fbea689227

Download Submit
\Users\Admin\AppData\Local\Temp\SoftManager.exe

Filesize
337KB

MD5
cffab901ec1573799473a7b4d110cf08

SHA1
4dae9fc43de6bb4b3b47fcac5348a104c4792988

SHA256
5ea1bb2021e94cd70d21bc51d586a1edc0cc1e584986cfc4460a2a98a828db97

SHA512
8ab0334dbad12047e743c51cd44aec3287e4c938b904b01b9586e73c10d3aa1f36347f00045c89a2ca2399d140b804be789c502251b9d5b9dc7610ab9dc9cd60

Download Submit
memory/1656-95-0x00000000006A0000-0x00000000006D5000-memory.dmp

Filesize
212KB

Download
memory/1656-91-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1656-92-0x00000000006A0000-0x00000000006D5000-memory.dmp

Filesize
212KB

Download
memory/1656-93-0x00000000006A0000-0x00000000006D5000-memory.dmp

Filesize
212KB

Download
memory/1656-94-0x00000000006A0000-0x00000000006D5000-memory.dmp

Filesize
212KB

Download
memory/1656-90-0x00000000006A0000-0x00000000006D5000-memory.dmp

Filesize
212KB

Download
memory/1708-26-0x0000000000370000-0x00000000003A5000-memory.dmp

Filesize
212KB

Download
memory/1708-25-0x00000000004D0000-0x00000000005D0000-memory.dmp

Filesize
1024KB

Download
memory/1708-77-0x0000000000370000-0x00000000003A5000-memory.dmp

Filesize
212KB

Download
memory/2684-48-0x00000000001C0000-0x00000000001F5000-memory.dmp

Filesize
212KB

Download
memory/2684-84-0x00000000001C0000-0x00000000001F5000-memory.dmp

Filesize
212KB

Download
memory/2928-78-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-62-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-75-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-74-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-80-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-72-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2928-81-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-73-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-55-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2928-79-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-76-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-60-0x0000000000270000-0x00000000002A5000-memory.dmp

Filesize
212KB

Download
memory/2928-59-0x00000000000D0000-0x00000000000D2000-memory.dmp

Filesize
8KB

Download
memory/2928-58-0x00000000000A0000-0x00000000000C4000-memory.dmp

Filesize
144KB

Download
memory/3008-61-0x00000000002E0000-0x0000000000315000-memory.dmp

Filesize
212KB

Download
memory/3008-54-0x00000000002E0000-0x0000000000315000-memory.dmp

Filesize
212KB

Download