MALICIOUS — 531d45aa3e1b8234b5be71a08a07db7fe0d621eacafc5b86c7c972c8e621ce7a

MALICIOUS — 531d45aa3e1b8234b5be71a08a07db7fe0d621eacafc5b86c7c972c8e621ce7a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 531d45aa3e1b8234b5be71a08a07db7fe0d621eacafc5b86c7c972c8e621ce7a
SHA-1: 95add7ab202ffa59bd4499d047f085bc325f62f2
MD5: d64337a5766aea58d09c59bfc93281b4
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE5uEGOivIlQqdcdNXwlYeNNZZ2f:8u+LIIX7gEGOiviQqdcdNXwlYeNNZO
TLSH: T14D577C0A3D376342E4BB99184D6A8F6E0C36787220EA2B4D9773692D39D70571163F38
Submitted as: 531d45aa3e1b8234b5be71a08a07db7fe0d621eacafc5b86c7c972c8e621ce7a
File type: pe · Size: 1543460 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 27 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

91407 behavior events · 3 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Sysmon64.exe - 3191fdc573ad99cffe00c59112f6f0d9738d2fc840c68ecb401602d0814ba244
C:\ThreatLens\agent.exe - d3c018919a9bef01a1cee5b5fb2b4756b45fee37432948c3888d46372758f161
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 0c34ca1ad0d00a27afd018e9dd049ac91d96da012891d3bfbde471e6496f4ae5
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 89147bcf4746c699a51c5d127fc1e73dd92aa19ecfa1b8d55693a474735a150f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 6e0dfaf6ff70c1bff4d25a7be25adea13d424404c5e418cb709f4602c17d626a
C:\Users\Public\Microsoft Build\Isass.exe - 831762e51895407f6c462adf65077fb21a9191d0cece0f10411a085368e19532
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - efa507154bcd88b023314ad95503807842d1b8eadf1c774114adb68dd9e36218

Embedded URLs

http://http.proxy.icq.com/hello
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787856659&P2=404&P3=2&P4=WVg3M%2bIcFJnjWs73m2k732SG2sjcJuewrLMNxo1XTpOB4sDkI%2feYox5zYb7nx9dKMhsHNNh595IaAn44vR7vqg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787856788&P2=404&P3=2&P4=eajdq5Aa3R8MTxu9BqKqtG0z7%2b74QBQTZpzMhVWgE8HX%2fIx30nP0RJATY1SIApR4cha0Juz3ZQ9O2CCTsDZrqw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

http.proxy.icq.com
login.icq.com
crl.microsoft.com
www.microsoft.com

Embedded IP addresses

0.0.0.1
20.184.175.12
48.211.4.16
4.230.171.124
40.84.97.4
52.230.59.222
74.179.77.204
4.150.223.108
74.178.240.51
20.165.94.63
20.76.201.171
52.123.129.14
52.123.128.14
20.42.73.31
203.26.79.13
135.234.160.244
162.159.142.9
52.110.12.45
52.110.12.5
74.178.232.29
52.148.114.188
172.178.240.162
72.153.5.97
20.184.175.8
52.123.252.248

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report