Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 16:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
General
-
Target
65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe
-
Size
169KB
-
MD5
e6e08021ab723911c125aaa41e9e498c
-
SHA1
bc0787835d7324b02da0dd3e285acd90d442b6ab
-
SHA256
65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36
-
SHA512
249e5ed74f74f5269d864839620a1f81e25783e122ee20df0e00c8278a8ddc8652dbadd7538bee3ef1e5ff54f776a6cb111ac7cb696f70049386e0fc5be87b1b
-
SSDEEP
1536:HYNndKj8fKeVPkFJeKT4W+UcTJ0ffzSeXIv1zSBF89HZzQGdTaOL+afoBJlXQp+p:1j8frmdcTOVKpIFG+GdIKoZi+EY9F
Malware Config
Signatures
-
Detects PlugX payload 19 IoCs
resource yara_rule behavioral2/memory/4740-0-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/4740-1-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/2332-3-0x0000000000E00000-0x0000000000E30000-memory.dmp family_plugx behavioral2/memory/4740-4-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/2332-7-0x0000000000E00000-0x0000000000E30000-memory.dmp family_plugx behavioral2/memory/2332-5-0x0000000000E00000-0x0000000000E30000-memory.dmp family_plugx behavioral2/memory/4740-25-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/4740-26-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/4740-24-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/4740-23-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/4740-12-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/5080-29-0x0000000002660000-0x0000000002690000-memory.dmp family_plugx behavioral2/memory/5080-31-0x0000000002660000-0x0000000002690000-memory.dmp family_plugx behavioral2/memory/5080-32-0x0000000002660000-0x0000000002690000-memory.dmp family_plugx behavioral2/memory/5080-33-0x0000000002660000-0x0000000002690000-memory.dmp family_plugx behavioral2/memory/5080-34-0x0000000002660000-0x0000000002690000-memory.dmp family_plugx behavioral2/memory/4740-35-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/4740-36-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx behavioral2/memory/4740-37-0x0000000000A30000-0x0000000000A60000-memory.dmp family_plugx -
Plugx family
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\CLASSES\FAST 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 36003000450030003500330031003400330031003900340033003600440045000000 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 5080 msiexec.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe 5080 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 5080 msiexec.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
pid Process 5080 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe Token: SeTcbPrivilege 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe Token: SeDebugPrivilege 2332 svchost.exe Token: SeTcbPrivilege 2332 svchost.exe Token: SeDebugPrivilege 5080 msiexec.exe Token: SeTcbPrivilege 5080 msiexec.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 2332 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 86 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90 PID 4740 wrote to memory of 5080 4740 65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe"C:\Users\Admin\AppData\Local\Temp\65f75ee79e0e4dd7a199eadfc5ccc337eb4a830d064ec9e4c66b63297d8bca36.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe 100 47402⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\system32\msiexec.exe 209 47402⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476B
MD533a16afad4b4aa233d47a74e3cbddacf
SHA1bad214393da5807d231cc647853304f251ad069e
SHA256e8f24659a0a6b766af0e1c819db5e5b8c15dc35d14bf7b8ccf9a97611c9d355d
SHA512da7891ebdb7eb169aedb312b5a74ecfd0dee8cf8761c9cfdfc23d0aaf79cec87f303354855e8142cd75909c8ff693d5579f70b6eacaf49404a45ff39574cf236