plugx | 7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2025, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe
Size 325KB
Sample251002-e5dcmsgr61
SHA256 7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c
MD5 d5f69a21bcc84e34b0df9d36ea5891d5
SHA1 949dcd6e21e97ad4a1743ddcd4a9eba8b75f4108
SHA512 56df2044d2e9934163c34f511e3387ae68dd66bc8e2cc2b6dab1be6d440763a02016842601573235dad5a164e3043fd3de3b907525295e5b332706622a3efad7
SSDEEP 6144:Xz+92mhAMJ/cPl3iNGhPnYxgYhWtxiPwZyM/bz5K:XK2mhAMJ/cPl/WgHQMjzI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery plugx trojan

Malware Config

Signatures

Detects PlugX payload 21 IoCs

resource	yara_rule
behavioral1/memory/3200-20-0x00000000008A0000-0x00000000008CC000-memory.dmp	family_plugx
behavioral1/memory/3200-21-0x00000000008A0000-0x00000000008CC000-memory.dmp	family_plugx
behavioral1/memory/3216-41-0x00000000006E0000-0x000000000070C000-memory.dmp	family_plugx
behavioral1/memory/3216-40-0x00000000006E0000-0x000000000070C000-memory.dmp	family_plugx
behavioral1/memory/4424-45-0x0000000000A40000-0x0000000000A6C000-memory.dmp	family_plugx
behavioral1/memory/5836-46-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-47-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-61-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-60-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-59-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-62-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-64-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-63-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/4424-67-0x0000000000A40000-0x0000000000A6C000-memory.dmp	family_plugx
behavioral1/memory/3200-68-0x00000000008A0000-0x00000000008CC000-memory.dmp	family_plugx
behavioral1/memory/3216-69-0x00000000006E0000-0x000000000070C000-memory.dmp	family_plugx
behavioral1/memory/4944-70-0x0000000000AC0000-0x0000000000AEC000-memory.dmp	family_plugx
behavioral1/memory/4944-73-0x0000000000AC0000-0x0000000000AEC000-memory.dmp	family_plugx
behavioral1/memory/4944-72-0x0000000000AC0000-0x0000000000AEC000-memory.dmp	family_plugx
behavioral1/memory/5836-74-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx
behavioral1/memory/5836-75-0x00000000009A0000-0x00000000009CC000-memory.dmp	family_plugx

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Plugx family
plugx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3001560346-2020497773-4190896137-1000\Control Panel\International\Geo\Nation	7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe

Deletes itself 1 IoCs

pid	Process
3200	hkcmd.exe

Executes dropped EXE 3 IoCs

pid	Process
3200	hkcmd.exe
3216	hkcmd.exe
4424	hkcmd.exe

Loads dropped DLL 3 IoCs

pid	Process
3200	hkcmd.exe
3216	hkcmd.exe
4424	hkcmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hkcmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hkcmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hkcmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\FAST	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\FAST\CLSID = 30003400430032004300340043003300350037004200330036004400420044000000	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3200	hkcmd.exe
3200	hkcmd.exe
5836	svchost.exe
5836	svchost.exe
5836	svchost.exe
5836	svchost.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
5836	svchost.exe
5836	svchost.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
5836	svchost.exe
5836	svchost.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
5836	svchost.exe
5836	svchost.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
5836	svchost.exe
5836	svchost.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe
4944	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5836	svchost.exe
4944	msiexec.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3200	hkcmd.exe
Token: SeTcbPrivilege	3200	hkcmd.exe
Token: SeDebugPrivilege	3216	hkcmd.exe
Token: SeTcbPrivilege	3216	hkcmd.exe
Token: SeDebugPrivilege	4424	hkcmd.exe
Token: SeTcbPrivilege	4424	hkcmd.exe
Token: SeDebugPrivilege	5836	svchost.exe
Token: SeTcbPrivilege	5836	svchost.exe
Token: SeDebugPrivilege	4944	msiexec.exe
Token: SeTcbPrivilege	4944	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5132 wrote to memory of 3200	5132	7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe	84
PID 5132 wrote to memory of 3200	5132	7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe	84
PID 5132 wrote to memory of 3200	5132	7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe	84
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 4424 wrote to memory of 5836	4424	hkcmd.exe	89
PID 5836 wrote to memory of 4944	5836	svchost.exe	93
PID 5836 wrote to memory of 4944	5836	svchost.exe	93
PID 5836 wrote to memory of 4944	5836	svchost.exe	93
PID 5836 wrote to memory of 4944	5836	svchost.exe	93
PID 5836 wrote to memory of 4944	5836	svchost.exe	93
PID 5836 wrote to memory of 4944	5836	svchost.exe	93
PID 5836 wrote to memory of 4944	5836	svchost.exe	93
PID 5836 wrote to memory of 4944	5836	svchost.exe	93

C:\Users\Admin\AppData\Local\Temp\7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe
"C:\Users\Admin\AppData\Local\Temp\7fa15019d341e91c6364cf71b73a764df7641980c50377e24fda2c8c1d9a6f3c.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5132
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\hkcmd.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\hkcmd.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3200

C:\ProgramData\Kerberos\hkcmd.exe
"C:\ProgramData\Kerberos\hkcmd.exe" 100 3200
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3216

C:\ProgramData\Kerberos\hkcmd.exe
"C:\ProgramData\Kerberos\hkcmd.exe" 200 0
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe 201 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\SysWOW64\msiexec.exe
    C:\Windows\system32\msiexec.exe 209 5836
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hccutils.DLL

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hccutils.DLL
Size 41KB
SHA256 7a593f93d52d7cecf2ad81ee2df0d1354a39bb975cec25619dcbe5cee57123cf
MD5 55c15efa6369957c69e7c6643bc86ef2
SHA1 ce2bacdc2eeb298016d46e61f4a009b2a706a737
SHA512 a6d06035f91410dc215d8ac8a22d955bd02084d3e409e81176046c9f1bbf0eff2328ab66ff90f0441004ddd7922fdd2d2c1b44f32b583ab78cb1015813d46705
SSDEEP 768:DWzzfQG/jNv5YJKZPZIUwLyEk1FQQMR09f:DWgu5v5hPZB/IR0
MD5 SHA1 SHA512 SSDEEP

Submit Download

hccutils.DLL.res

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hccutils.DLL.res
Size 110KB
SHA256 b414a5ffb5b41d46d963c22964ae3097538c0a3e7ce0e3ba235ca33de3ab717d
MD5 3aa819b9089cd906d6434e446bea75ba
SHA1 8e008e0eb41830841eeb4702c382a43757ad930e
SHA512 c09d075044ef7b74c928238aaa1b78c952970280a68213db108d7bdc02fea24a0f6424a745dbf4fb33de93f3b8d8341b7f99e5c47dadd0fda9083e6cc596b965
SSDEEP 1536:/iE5dstYrYA6kaq72JwBHYvkW6wD5O7N96BAG/zHivZdWqPE/FGafEE:/7+YrrznjJWt6axziPW4ENP
MD5 SHA1 SHA512 SSDEEP

Submit Download

hkcmd.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\hkcmd.exe
Size 169KB
SHA256 e2c6ec8ea8da05b23327c1d0e350e219c4823d41c2ed98bae9bd2d9b48b8613d
MD5 0d58e5f4e82539de38ba7f9b4a8dda12
SHA1 dd0f39f4d77e1bb347321aa22b5a9d5c1cc65342
SHA512 149c5dcb225829744d632d9c118427c5074d0413246b6e08470cac2aeffdf25504007b98219d6b2b454a20069065168c4c21ad4d9d926d98ab97c45585f37ee3
SSDEEP 3072:44xn6X9fhgyYi+qRgKSggnZQk0c6HDAosD5IlVz:v+5YsRg8w4DzsilN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3200-19-0x00000000021B0000-0x00000000022B0000-memory.dmp

Download

memory/3200-20-0x00000000008A0000-0x00000000008CC000-memory.dmp

Download

memory/3200-21-0x00000000008A0000-0x00000000008CC000-memory.dmp

Download

memory/3200-68-0x00000000008A0000-0x00000000008CC000-memory.dmp

Download

memory/3216-41-0x00000000006E0000-0x000000000070C000-memory.dmp

Download

memory/3216-40-0x00000000006E0000-0x000000000070C000-memory.dmp

Download

memory/3216-69-0x00000000006E0000-0x000000000070C000-memory.dmp

Download

memory/4424-67-0x0000000000A40000-0x0000000000A6C000-memory.dmp

Download

memory/4424-45-0x0000000000A40000-0x0000000000A6C000-memory.dmp

Download

memory/4944-72-0x0000000000AC0000-0x0000000000AEC000-memory.dmp

Download

memory/4944-73-0x0000000000AC0000-0x0000000000AEC000-memory.dmp

Download

memory/4944-71-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/4944-70-0x0000000000AC0000-0x0000000000AEC000-memory.dmp

Download

memory/5836-58-0x0000000000990000-0x0000000000991000-memory.dmp

Download

memory/5836-63-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-47-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-46-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-64-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-61-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-62-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-59-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-60-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-74-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download

memory/5836-75-0x00000000009A0000-0x00000000009CC000-memory.dmp

Download