MALICIOUS — 157c5272db716814176a1a6296999eeda5676fe09c2415ee461903368f8bdfc9

MALICIOUS — 157c5272db716814176a1a6296999eeda5676fe09c2415ee461903368f8bdfc9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 157c5272db716814176a1a6296999eeda5676fe09c2415ee461903368f8bdfc9
SHA-1: 8d2b0529ce86f7e7313f0211a2a20777f914c5fe
MD5: 48d316d43bd5cec16b8062b618ebe5b4
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 24576:8UzpqaMoJVqyda+pBUYVEEpQQJvKPzvYZHTHy7y:8QpCoHj87YTKPzvoS7y
TLSH: T1D655CFD8031D6303CC7967641D40EE4D9911B2BBE1BD027E1B5A523E3AAB7A344A24F7
Submitted as: 157c5272db716814176a1a6296999eeda5676fe09c2415ee461903368f8bdfc9
File type: pe · Size: 1290544 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (8 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.ev (rule Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com, 6.0.1.0 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

68968 behavior events · 2 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Program Files\7-Zip\7z.exe - d43b4cc8fa44f940d5ccc3541103ddce7caedcde4f9087994526aa224ded31ac
C:\Program Files\7-Zip\7zFM.exe - ff35386219a510be6be9638baefc561b335a6e8fa709774f27d2d802aac12d03
324e5b5b995b28f49f33925133fc97cd799110323685ea212f0fbf964d3bae55 - 324e5b5b995b28f49f33925133fc97cd799110323685ea212f0fbf964d3bae55
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.exe - 60f027a12679edbf0d1a1ab9aeb6e0121c8a1540f0bfc61476c81b1e693f6fb0
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 2765053ee0188e2f8528b928cfed6fcf4123f6a9f3448114bd897b0d1f1d8044
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - fa667d3bc0688ddae411b80e10b2b1a0609184d44e9096e2cda6c3a4ab253092
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
5ea94bdef711f1de2a27ad9d76a78e01e777aa85331eeb5445febf6e75400d4a - 5ea94bdef711f1de2a27ad9d76a78e01e777aa85331eeb5445febf6e75400d4a
C:\Program Files\7-Zip\7zG.exe.exe - c98715789f198fb88851cd5f64a6dc578967785453d5745a9703f9d1c5ae1dd6
19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b - 19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b
C:\Users\analyst\AppData\Local\Temp\tsk_b621f128d5cb4131.exe.exe - 835bce7bf1cc977148ff9d364b124db6b09338514a63ffa57b1d7ffbbc45dfbf
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 7e9db9c1f6c9ec504936026a0a1f100d80bdb278e0176cf185e8644298a641d4
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 43298b4d6144300c012e10c4cce2b9a40e73753797eec0a62c58d1b5d1c66d5d
C:\Sysmon64.exe - cf0d0760ef7cdffb2634173da1e9d94501dbe8f54447f36c3407a859f7fe3cdd

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.verisign.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.eyuyan.com
wtqq.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

6.0.1.0
4.150.223.99
52.123.252.245
52.230.60.54
4.230.171.124
40.84.97.4
74.178.76.128
20.184.175.3
74.178.240.51
20.42.179.204
40.84.85.40
85.210.193.152
4.247.188.233
57.155.104.224
57.155.101.212
134.33.185.100
20.42.65.89
48.211.4.16
135.234.160.244
172.215.188.232
172.215.188.225
20.42.179.192
72.145.35.105
52.148.114.188
52.110.12.31

File paths

d:\office\source\otools\inc\util\ocfx\othreadlocal.h
d:\office\source\util\ocfx\oexceptionmanager.cpp
d:\office\source\util\ocfx\olog.cpp
d:\office\source\util\ocfx\ofile.cpp
d:\office\source\setupexe\catalyst\catcore\catconfig.cpp
d:\office\source\setupexe\lis\logic\lis.h
d:\office\source\util\ocfx\oxmlelement.cpp
d:\office\source\util\ocfx\oxmlnodelist.cpp
d:\office\source\util\ocfx\oregistrykey.cpp
d:\office\source\util\ocfx\oxmlnode.cpp
d:\office\source\util\ocfx\oxmlnamednodemap.cpp
d:\office\source\util\ocfx\oxmldocument.cpp
d:\office\source\otools\inc\util\ocfx\ocomutility.h
d:\office\source\otools\inc\util\ocfx\optr.h
d:\office\source\util\ocfx\oversion.cpp
d:\office\source\util\ocfx\olibrary.cpp
d:\office\source\otools\inc\util\ocfx\oalloc.h
d:\office\source\util\ocfx\ostring.cpp
d:\office\source\otools\inc\util\ocfx\ostacktrace.h
t:\setupexe\x86\ship\0\setup.pdb
T:\:t:x:
J:\:d:
T:\:d:l:t:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report