MALICIOUS — 21ce8f22682c662463a55d29515b9778103fd4a3f26bbf4f6d9d940d2557ccf2

MALICIOUS — 21ce8f22682c662463a55d29515b9778103fd4a3f26bbf4f6d9d940d2557ccf2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 21ce8f22682c662463a55d29515b9778103fd4a3f26bbf4f6d9d940d2557ccf2
SHA-1: ee35d58f7c1e332a06e41b2d763920623197a045
MD5: 5d4e4cf76f527e39ce3f31bce6b21478
imphash: 0a5b71014bc151e12a17149b76079a38
ssdeep: 24576:/rRoNk7BZpr+h/7dym9YP1ZKXH9p0yLZTCph/bTi:/rRokpr+Cm9YeX8GZGHzTi
TLSH: T18757BFC8A8492345CA3FAB942C803E0E9CADB55211BDA64C7687D12F11EFC779035F5A
Submitted as: 21ce8f22682c662463a55d29515b9778103fd4a3f26bbf4f6d9d940d2557ccf2
File type: pe · Size: 1531904 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

19875 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05 - ccc3a506a50a05a4728233dc04569ef5b412ad987511ccfb333788eafb69d0a2
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB - a6a8899494a3a77dfc4e23fbc7554f78ef46df389f31ada60ac12b24a6a37501
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 - 9ba44c040b798337f0c4d680109df739b6127330a062c20553fe76528b609884
C:\Users\analyst\AppData\Local\Temp\AdobeARM.log - 4ed67f86ae89888fdcf8798897b9e33648b6e60e8d30401caddb8fb952ec88d1
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 - a582eb9a0a0d65bb0b4175d1e60ea1b2648d9783657f0124796de7b89939efa8
C:\Users\analyst\AppData\Local\Temp\Tmp6129.tmp - 07f5485853eb44db90bd99d7c7328dd3d23e83ab09d7a0a88c2f703d92fb7c53
C:\Windows\Temp\ArmReport.ini - 5016d37c747967c80842fead8e12767cf6abcbce47a88bb5ad9f13c2b1600faa
C:\Users\analyst\AppData\Local\Temp\{9c7cedf7-9779-4d25-9b56-a97540237995}.png - f3335e652639a387b7532280039027c9102a7da2b28ce72b336c4634b002c768
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A - c5f1b344dfb46174b00827215ecf4039352062c14d1dc71b0c33b5662740d3ac
C:\Users\analyst\AppData\Local\Temp\Tmp3A07.tmp - aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
C:\Windows\Temp\AdobeARM.log - 7e64bae598dc2ae7cc0e27e2b34a8a0dd1d802ba070d118ca80b70f09f27dae8
C:\Windows\Temp\ArmUI.ini - 790b06745f32e0f56a7af24c871ffce225ba05ebf0d8f8a71a00c727c97dcf09
C:\Users\analyst\AppData\Local\Adobe\ARM\S\ArmManifest3.msi - 4a96463a1112ebe2c25293aacb1a4c4550d67cb827fd9333b8ed4d99ea60a0b3
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB - d72ae9996e8e21fa2d4a5f0c7690c70ffc6c3efdec06c8d53e7fef1596319925
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05 - 32802566c142f146be566da5bcb2a24bca1a12392475fd49c993b00ecf2b1d50

Embedded URLs

https://armmf.adobe.com/arm-manifests/win/
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
http://www.symauth.com/cps09
http://evcs-crl.ws.symantec.com/evcs.crl0
http://evcs-aia.ws.symantec.com/evcs.cer0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

armmf.adobe.com
www.adobe.com
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
www.eyuyan.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.7.2.0
4.150.223.104
4.144.132.114
4.230.171.124
135.233.45.223
172.66.2.5
20.184.175.1
20.184.175.16
57.155.101.212
184.84.165.136
52.148.114.188
72.145.35.108
52.110.12.14
52.110.12.5

Registry keys

HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\Exe
HKLM\SOFTWARE\RegisteredApplications

File paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb
X:\:`:
X:\:`:d:h:l:p:@;D;H;L;P;T;X;\;`;
X:\:`:d:h:p:t:x:
X:\:`:d:h:l:p:t:x:
T:\:h:
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report