SUSPICIOUS — c4feaf02.exe

SUSPICIOUS — c4feaf02.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (69/100), attributed to the HUILoader family. 2 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 141aad7289967b09c8aa65fec2de133b587fef7b2ac2c671eca63c48d1447723
• SHA-1: 7fd414013b8eb841ba786d95c0dadbdbb3ddcd21
• MD5: a2b29f58281ea2fb6064ea21b38e910f
• imphash: 51d2e710e1807d697676bab28342d470
• ssdeep: 49152:DBXcY6kqZRwisgBuBqrpTw1TUmOaJTw32RCn2d2/:VcYysguWTeUyJTw35d
• TLSH: T1845D5BA5B800B519C9B75D6534850E0C50A5E0F7B9FB288CA742D12D77BFC87A2CF06A
• Submitted as: c4feaf02.exe
• File type: pe · Size: 2710440 bytes
• Verdict: suspicious (69/100) · Family: HUILoader

Detections (2 of 56 engines)

• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

• T1547.001
• T1497

Why this verdict

The suspicious score of 69/100 is the fusion of 4 weighted signals:

• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://ocsp.globalsign.com/rootr30
• http://secure.globalsign.com/cacert/root-r3.crt06
• http://crl.globalsign.com/root-r3.crl0G
• https://www.globalsign.com/repository/0
• http://ocsp.globalsign.com/codesigningrootr450F
• http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
• http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0

Embedded domains

• touch.kaspersky.com
• click.kaspersky.com
• ocsp.globalsign.com
• secure.globalsign.com
• crl.globalsign.com
• www.globalsign.com
• cacerts.digicert.com
• crl3.digicert.com

Registry keys

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\
• HKLM\System\CurrentControlSet\services\%%~ni
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• HKLM\SYSTEM\
• HKLM\SYSTEM\Select
• HKLM\SYSTEM\Select\Current
• HKLM\SYSTEM\CurrentControlSet

File paths

• c:\a\c\d_00000000\s\product\removal_tools\kvrt\.delivery\pdk_instrumental.zip_60771a5c\include\component\eka\system\datetime\windows\datetime.h
• c:\a\c\d_00000000\s\product\removal_tools\kvrt\.delivery\pdk_instrumental.zip_60771a5c\include\component\eka\rtl\objclient.h
• c:\a\c\d_00000000\s\product\removal_tools\kvrt\.delivery\pdk_instrumental.zip_60771a5c\include\component\eka\rtl\objbase.h
• C:\a\c\d_00000000\s\product\removal_tools\output\out_Win32\Release\KVRT.pdb
• V:\:b:h:n:t:z:
• F:\:v:
• S:\:
• S:\:w:
• X:\:`:d:h:l:v;
• S:\:t:}:
• X:\:`:d:h:l:p:t:x:
• C:\:i:
• F:\:q:
• X:\:l:p:
• X:\:t:
• X:\:d:
• H:\:`:p:t:x:
• L:\:`:d:
• X:\:t:x:
• T:\:h:p:
• T:\:d:l:t:
• L:\:d:p:
• L:\:d:l:t:
• T:\:
• T:\:d:p:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report