plugx | d05255f0fa586e5eca2e7d5c15451843e20810139596dc5695a8deaa4c3d7882

Resubmissions

23/01/2026, 17:57

260123-wj35lscz8g10

23/01/2026, 17:50

260123-wevyfacx7f10

Analysis

max time kernel
12s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20251231-en
resource tags

arch:x64arch:x86image:win10v2004-20251231-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HPSmart.exe
Size 1.9MB
Sample260123-wevyfacx7f
SHA256 b30239064a8ff5ede80b2a97508fb58ad8c39d6bbe27b3ce5d6dc9564dcf766b
MD5 5475767bdb89f712cd6272797857af04
SHA1 3508fc2ba5a3508f88cfcffdbb0808b498a04b03
SHA512 316caf60955a3b7b3ac5beca07e48d941cb9ab27d8a697ae90e98a59e955adee686b415f38d1276cc181c68d80ead4f5d7bd239a37352cdf2d048866d96ed849
SSDEEP 49152:cCqBiiacEvl6ooqyE+DGgW0fQi6WKsGMCrPqrKxRkfUzavFg9SirFDGIiCGgPLZj:mMiaXliqy3GgWyF6WKsGDrPq2LkLFtiP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery execution plugx persistence trojan

Malware Config

Signatures

Detects PlugX of Earth Preta campaign 13 IoCs

resource	yara_rule
behavioral3/memory/4720-9-0x0000000002B40000-0x0000000002BB6000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/4720-2-0x0000000003B90000-0x0000000007814000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/5276-18-0x00000000027B0000-0x0000000002826000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/6116-19-0x0000000003980000-0x00000000039F6000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/5276-20-0x0000000002FB0000-0x0000000006C34000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/6116-21-0x0000000003A00000-0x0000000007684000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/5276-22-0x0000000002FB0000-0x0000000006C34000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/5276-23-0x0000000002FB0000-0x0000000006C34000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/5276-24-0x0000000002FB0000-0x0000000006C34000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/2132-31-0x0000000003570000-0x00000000071F4000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/5144-32-0x0000000003C40000-0x00000000078C4000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/5332-40-0x0000000003800000-0x0000000007484000-memory.dmp	family_plugx_earth_preta
behavioral3/memory/3568-41-0x00000000040B0000-0x0000000007D34000-memory.dmp	family_plugx_earth_preta

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Plugx family
plugx

Executes dropped EXE 2 IoCs

pid	Process
5276	HPSmart.exe
6116	HPSmart.exe

Loads dropped DLL 2 IoCs

pid	Process
5276	HPSmart.exe
6116	HPSmart.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HPSmartUpdate = "\"C:\\Users\\Public\\HPSmartclbl\\HPSmart.exe\" 734"	HPSmart.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2912682655-2448277277-4252517302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HPSmartUpdate = "\"C:\\Users\\Public\\HPSmartclbl\\HPSmart.exe\" 734"	HPSmart.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HPSmart.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe
Key created	\REGISTRY\USER\S-1-5-21-2912682655-2448277277-4252517302-1000_Classes\ms-pu	HPSmart.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\ms-pu\CLSID = 43003700320045004400300043003500320038004400380033003100320030000000	HPSmart.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\ms-pu	HPSmart.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2060	schtasks.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5276	4720	HPSmart.exe	92

C:\Users\Admin\AppData\Local\Temp\HPSmart.exe
"C:\Users\Admin\AppData\Local\Temp\HPSmart.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Public\HPSmartclbl\HPSmart.exe
  C:\Users\Public\HPSmartclbl\HPSmart.exe 734
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:5276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c SCHTASKS.exedel %0 /tn "HPSmart Update" /f
    3⤵
    PID:4196
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c SCHTASKS.exe /create /sc minute /mo 30 /tn "HPSmart Update" /tr """"C:\Users\Public\HPSmartclbl\HPSmart.exe""" 437" /f
    3⤵
    PID:3932
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /create /sc minute /mo 30 /tn "HPSmart Update" /tr """"C:\Users\Public\HPSmartclbl\HPSmart.exe""" 437" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c SCHTASKS.exe /run /tn "HPSmart Update"
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /run /tn "HPSmart Update"
      4⤵
      PID:808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "AdobeDesktop" /f
    3⤵
    PID:3372
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "AdobeDesktop" /f
      4⤵
      PID:5936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1" /f
    3⤵
    PID:3360
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1" /f
      4⤵
      PID:5148
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_2" /f
    3⤵
    PID:4800
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_2" /f
      4⤵
      PID:5580
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "ZBT_0.1" /f
    3⤵
    PID:5260
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "ZBT_0.1" /f
      4⤵
      PID:1896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "LKUFORYOU_1" /f
    3⤵
    PID:4016
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "LKUFORYOU_1" /f
      4⤵
      PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "AcroRd32" /f
    3⤵
    PID:5712
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "AcroRd32" /f
      4⤵
      PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1.00" /f
    3⤵
    PID:3220
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1.00" /f
      4⤵
      PID:5628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "LKUFORYOU_2" /f
    3⤵
    PID:2668
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "LKUFORYOU_2" /f
      4⤵
      PID:1124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1.03" /f
    3⤵
    PID:2620
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1.03" /f
      4⤵
      PID:5152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c SCHTASKS.exe /delete /tn "udisk_1.02" /f
    3⤵
    PID:5840
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS.exe /delete /tn "udisk_1.02" /f
      4⤵
      PID:6088

C:\Users\Public\HPSmartclbl\HPSmart.exe
"C:\Users\Public\HPSmartclbl\HPSmart.exe" 734
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6116

C:\Users\Public\HPSmartclbl\HPSmart.exe
C:\Users\Public\HPSmartclbl\HPSmart.exe 437
1⤵
PID:2132

C:\Users\Public\HPSmartclbl\HPSmart.exe
"C:\Users\Public\HPSmartclbl\HPSmart.exe"
1⤵
PID:5144
- C:\Users\Public\HPSmartclbl\HPSmart.exe
  C:\Users\Public\HPSmartclbl\HPSmart.exe 978
  2⤵
  PID:5332

C:\Users\Public\HPSmartclbl\HPSmart.exe
"C:\Users\Public\HPSmartclbl\HPSmart.exe" 978
1⤵
PID:3568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HPReport.exe

Path C:\Users\Public\HPSmartclbl\HPReport.exe
Size 3.3MB
SHA256 492df82529abe6cb8e927fb1513a4e250c293ec86d802a313515d944d6ea7018
MD5 5ccecdd7a28ebb0401cc98e7fd89ba71
SHA1 b5bafbe629650150c87f4b0fe0c7ddaf1eb7751e
SHA512 0ebb40aadcd8da7bb5de423417026d01ac64dbe882737cf58a98807ca2105f0a8cb7547c9b8d8138d0a4cbd609e8fc0ce0988973d0e25b18d5eeeb168c730e74
SSDEEP 98304:R/Fuk7b1n4vJfqvK+MiKibCh2VhFLOAkGkzdnEVomFHKnPtPv:RbbJKibCh2LFLOyomFHKnPtn
TLSH
T1D4F5BE513E88B86AD4530E31BE99F67FF1EEBCB41A3B03471191B6197A326414B1DC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HPSmart.exe

Path C:\Users\Public\HPSmartclbl\HPSmart.exe
Size 1.9MB
SHA256 b30239064a8ff5ede80b2a97508fb58ad8c39d6bbe27b3ce5d6dc9564dcf766b
MD5 5475767bdb89f712cd6272797857af04
SHA1 3508fc2ba5a3508f88cfcffdbb0808b498a04b03
SHA512 316caf60955a3b7b3ac5beca07e48d941cb9ab27d8a697ae90e98a59e955adee686b415f38d1276cc181c68d80ead4f5d7bd239a37352cdf2d048866d96ed849
SSDEEP 49152:cCqBiiacEvl6ooqyE+DGgW0fQi6WKsGMCrPqrKxRkfUzavFg9SirFDGIiCGgPLZj:mMiaXliqy3GgWyF6WKsGDrPq2LkLFtiP
TLSH
T173958E3177F2D077D2733A30952EE379A6B9B6700E39434B52904E3D2EB15C2992876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstanceFinderDlg.dat

Path C:\Users\Public\HPSmartclbl\InstanceFinderDlg.dat
Size 469KB
SHA256 2d53ae31c6df51173129d12a90f11b0412e12bb4d9901042d162d66a18880eac
MD5 3d96797cc297b8cdf4c9f4a52c035c48
SHA1 c1b53f3b1e02fd5be70d94cc944ba1f1eebdd252
SHA512 50a786f3de022b0c8328e2a560df1d23137b8c68aa2ead6b9b714af07591558656d715239fda72d262a6f43457260d1489b730e6ca6d2e8c7ab7f6d685648144
SSDEEP 6144:eD8noYrAH1TrR+orPFmJo1YD50XZyP/I7Y+hEeBY/oi2IQU4NEKb0+zDcLx:eDyUrRtw9D5I4/IjEeawitB8Ex
TLSH
T1BAA41A212851CAFA58F7556F05AF431963B1E52DC4DAFDC8A6D28BCFDAB2148C1B7B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstanceFinderDlgUI.dll

Path C:\Users\Public\HPSmartclbl\InstanceFinderDlgUI.dll
Size 754KB
SHA256 4a0dfe9a33ce169986ffef8d40a44f2ae868b15976443b5b87756c8146d27478
MD5 dd0a9a725528bbf363ee7ad0a4fabdea
SHA1 150fd577f5017d590cfdeb93b2160d21816b59c4
SHA512 fbf277a37fe8a214b4fde6ce5d9994f55f7c42cc59eb0f855ae540c6317163a7a729b8326ff2125a9241244658a3a4d853b8c4ea9cd315dacbd6ec67bf62ed09
SSDEEP 12288:hvhS4iOAZRC3E+L6IR+KVDh4WKpUHg5XuuZKlEGq8H9WN/4r2fi7OBzDp:hZS4nAZRMUKJhEpSg5XlhGq8HQNQifio
TLSH
T1F0F45C5149CE40E2F5C51AB328FBF75A25B2377295708EDBC2A8AD4DD3643E242C391E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2132-31-0x0000000003570000-0x00000000071F4000-memory.dmp

Download

memory/2132-29-0x0000000002D20000-0x0000000002D96000-memory.dmp

Download

memory/3568-41-0x00000000040B0000-0x0000000007D34000-memory.dmp

Download

memory/3568-39-0x0000000004030000-0x00000000040A6000-memory.dmp

Download

memory/4720-2-0x0000000003B90000-0x0000000007814000-memory.dmp

Download

memory/4720-9-0x0000000002B40000-0x0000000002BB6000-memory.dmp

Download

memory/4720-1-0x0000000002B40000-0x0000000002BB6000-memory.dmp

Download

memory/4720-0-0x0000000002B40000-0x0000000002BB6000-memory.dmp

Download

memory/5144-32-0x0000000003C40000-0x00000000078C4000-memory.dmp

Download

memory/5144-30-0x0000000003BC0000-0x0000000003C36000-memory.dmp

Download

memory/5276-24-0x0000000002FB0000-0x0000000006C34000-memory.dmp

Download

memory/5276-23-0x0000000002FB0000-0x0000000006C34000-memory.dmp

Download

memory/5276-22-0x0000000002FB0000-0x0000000006C34000-memory.dmp

Download

memory/5276-20-0x0000000002FB0000-0x0000000006C34000-memory.dmp

Download

memory/5276-18-0x00000000027B0000-0x0000000002826000-memory.dmp

Download

memory/5276-16-0x00000000027B0000-0x0000000002826000-memory.dmp

Download

memory/5332-38-0x00000000026B0000-0x0000000002726000-memory.dmp

Download

memory/5332-40-0x0000000003800000-0x0000000007484000-memory.dmp

Download

memory/6116-21-0x0000000003A00000-0x0000000007684000-memory.dmp

Download

memory/6116-19-0x0000000003980000-0x00000000039F6000-memory.dmp

Download

memory/6116-17-0x0000000003980000-0x00000000039F6000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads