MALICIOUS — 56fb67d3db2f0252231fbf6e9fb863c49406e54f9c3deb15032b07315e216b7d
MALICIOUS — 56fb67d3db2f0252231fbf6e9fb863c49406e54f9c3deb15032b07315e216b7d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 8 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.
Identification
- SHA-256:
56fb67d3db2f0252231fbf6e9fb863c49406e54f9c3deb15032b07315e216b7d - SHA-1:
9784711785a5eba022a473eccb809573c6d812e2 - MD5:
b3ed3a214e05a28b25f0cbc3edec4010 - imphash:
f5e2fae08fb1c8fba965c988eb10e880 - ssdeep:
98304:8ugIIr/iNu2zPnj/7pxX5D2Lovn3m/8YsKIA7JZnouyhfSuK:+YBzzX5D2Lovn3m/8YsKpJxouyhBK - TLSH:
T1EE5F7CFF861AE701CAF5DB341C63AEAD1021B4E5217E751E0A03C83F6697423BD650A9 - Submitted as: 56fb67d3db2f0252231fbf6e9fb863c49406e54f9c3deb15032b07315e216b7d
- File type: pe · Size: 3204328 bytes
- Verdict: malicious (100/100) · Family: HUILoader
Detections (8 of 55 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Malware.Generickdz-9832066-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Vindor!pz
- Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
- Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 17 weighted signals:
- ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule
Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 21 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://http.proxy.icq.com/hello, 6.0.1.0 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
100568 behavior events · 3 ATT&CK techniques · 8 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe -
ee5733a7e3bd9aa3546aaf747626ff1cc4ab6815446bd5ad9697cd4b36192dc4 - C:\Users\analyst\AppData\Local\Temp\NBRCC -
9f79443007dac54b548672517f288638086e43765b19c65e73aab11ad002a933 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe -
f4144586dfe07b3f8ce52431f89cfd145ef751d274c79cc5a6fe27f12dcca334 - C:\Sysmon64.exe -
db24f5e5475f87f2c81675d9b2669cb8b770936eb08740080e5f8fd831ab4c3e - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe -
4b252b8541d98644af97d144e64fc376fa3c1aec775cdbe31925fdbe398d327b - C:\Users\Public\Microsoft Build\Isass.exe -
7d78a45c96847ce8c38061d57ad93c4171ac9ebd6adf2ca899617717ce98a8dc - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe -
815c20c9ce9d067f5abe2b0b7f84bf5f756c5e7caa5015fcdccaa5525a15cda8 - C:\ThreatLens\agent.exe -
cc076ce56e51aa138b35c65bd12d954f061ebfbf718dc097f4f6efd75d84e8e5
Embedded URLs
- http://http.proxy.icq.com/hello
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://office.microsoft.com/0
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://msdn.microsoft.com/en-us/library/windows/desktop/ms753129
- http://www.w3.org/2000/09/xmldsig#
- https://nexus.officeapps.live.com
- http://www.w3.org/1999/XSL/Transform
- http://schemas.microsoft.com/windows/2004/02/mit/task
- http://officecdn.microsoft.com/sg
- http://officecdn.microsoft.com/db
- http://officecdn.microsoft.com/pr
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787905574&P2=404&P3=2&P4=EN6OUZCpVd3JXBL9IqFfk7LH4kA0x58LCscHD34e2zVamNSoS%2fvyCph3uHFKT9wGLxSqhfQemIOqWJxDrTap3A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787905626&P2=404&P3=2&P4=nvQ6jkZkIiyN8hdFqJW6kD5qiBGHx6S%2bs9PATdmKYiqEO4J6g7f5vzqbSAhczDOJF1zT8x9nmA5yVVf38jU4Hg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- http.proxy.icq.com
- login.icq.com
- crl.microsoft.com
- www.microsoft.com
- office.microsoft.com
- corp.microsoft.com
- outlook.network
- msdn.microsoft.com
- www.w3.org
- nexusrules.officeapps.live.com
- nexus.officeapps.live.com
- schemas.microsoft.com
- officecdn.microsoft.com
Embedded IP addresses
- 0.0.0.1
- 6.0.1.0
- 52.168.117.168
- 4.230.171.124
- 52.253.84.76
- 172.215.188.225
- 74.179.77.204
- 135.232.92.34
- 20.184.175.9
- 74.178.240.51
- 20.184.175.8
- 203.26.79.13
- 20.76.201.171
- 52.123.128.14
- 40.103.64.226
- 52.123.129.14
- 172.66.2.5
- 135.234.160.245
- 172.178.240.162
- 52.148.114.188
- 72.145.35.111
- 52.110.12.2
- 52.110.12.56
File paths
- P:\Target\x86\ship\click2run\x-none\integrator.pdb
- W:\:a:g:u:
- R:\:
- X:\:`:d:h:l:p:t:
- P:\:h:p:x:
- X:\:x;
- X:\:`:d:h:l:p:t:x:
- T:\:d:l:t:
- T:\:
- T:\:t:
More HUILoader samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report