Trend Micro’s MxDR team found x32dbg.exe, a legitimate Windows debugger, being used to sideload a PlugX variant via DLL Search Order Hijacking. The operation establishes persistence across multiple locations, uses scheduled tasks and Run keys, and culminates in a UDP backdoor communicating with a C2 server.
#PlugX #x32dbg #x32bridge #akm.dat #Groza_1.dat
#PlugX #x32dbg #x32bridge #akm.dat #Groza_1.dat
Keypoints
- The malicious chain starts with x32dbg.exe being used to sideload a PlugX DLL (Trojan.Win32.KORPLUG.AJ.enc) via DLL Search Order Hijacking (T1574.001).
- x32dbg.exe is a legitimate, signed tool, which helps threat actors bypass detection and maintain persistence.
- the malware copies components to three different directories to establish persistence and evade detection.
- A scheduled task LKUFORYOU_1 is created to run x32dbg.exe every five minutes, ensuring recurring execution.
- A Run registry entry is created to auto-start x32dbg.exe at user logon, enhancing persistence.
- The attack chain includes rundll32 usage to execute akm.dat, leading to the next stage loader AUG.exe and a UDP backdoor that exfiltrates host info to a C2 server at 160.20.147.254.
MITRE Techniques
- [T1574.001] DLL Search Order Hijacking – ‘…via the DLL Search Order Hijacking or T1574.001 technique to sideload a malicious DLL…’
- [T1218.011] Rundll32 – ‘rundll32 SHELL32.DLL, ShellExec_RunDLL rundll32 C:ProgramDataUsersDateWindows_NTWindowsUserDesktopakm.dat,Start’
- [T1053.005] Scheduled Task – ‘the scheduled task is set to execute the x32dbg.exe file… every five minutes’
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – ‘Registry Key: HKCUSoftwareMicrosoftWindowsCurrentVersionRun’ … ‘x32dbg.exe’
- [T1036] Masquerading – ‘x32dbg.exe is a legitimate executable of a debugging software’
- [T1120] Peripheral Device Discovery – ‘enumerates all drives and takes note of removable drives for its propagation routine’
Indicators of Compromise
- [File] Malicious components involved – x32dbg.exe ec5cf913773459da0fd30bb282fb0144b85717aa6ce660e81a0bad24a2f23e15, x32bridge.dll 0490ceace858ff7949b90ab4acf4867878815d2557089c179c9971b2dd0918b9, akm.dat 0e9071714a4af0be1f96cffc3b0e58520b827d9e58297cb0e02d97551eca3799, x32bridge.dat e72e49dc1d95efabc2c12c46df373173f2e20dab715caf58b1be9ca41ec0e172, DismCore.dll b4f1cae6622cd459388294afb418cb0af7a5cb82f367933e57ab8c1fb0a8a8a7, Groza_1.dat 553ff37a1eb7e8dc226a83fa143d6aab8a305771bf0cec7b94f4202dcd1f55b2
- [IP] C2 Server – 160.20.147.254