MALICIOUS — 6377d06ed3cb1dd6788b61701d2270fa4a27973976436d9761a5bb283b1370b9

MALICIOUS — 6377d06ed3cb1dd6788b61701d2270fa4a27973976436d9761a5bb283b1370b9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 6377d06ed3cb1dd6788b61701d2270fa4a27973976436d9761a5bb283b1370b9
SHA-1: 5b561e3fed0e378a3e967c55393c842319dfd7cc
MD5: 6bdc8f77ccbcb31eaa0bbeca8531f878
imphash: f6b0408cc4c85e3c6cfedf15fd1decc9
ssdeep: 6144:vIGEnprZkRs38t54c6rzNdf2WIGEnprZkRs38F:vxEnAR934iWxEnAR9F
TLSH: T115440229842EA242EC545BE8A29C1D2C819FECCBB04A5C83D75F4135D56B27742F5C73
Submitted as: 6377d06ed3cb1dd6788b61701d2270fa4a27973976436d9761a5bb283b1370b9
File type: pe · Size: 262144 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Generickdz-9954155-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Regrun!pz
Trellix Stinger (McAfee): Trojan-FUJH!D25EA9B9BEC3
Kaspersky (KVRT): Trojan-Ransom.Win32.Blocker.iyjg

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9954155-0 (rule Win.Malware.Generickdz-9954155-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (HUILoader): msvbvm60.dll - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

55218 behavior events · 2 ATT&CK techniques · 26 dropped files.

Dropped files

C:\Explorer\Index.htm - 1a8278f742de759e24415028a01b9e2a794cfaeeb1af2a28e55866b64594c374
C:\Windows\Desktop.ini - ee3aaf1bcc2539bdddb6f25f4d0902cd023d83d902196d1bf2fcd37a73469038
C:\Users\analyst\Local Settings\Application Data\WINDOWS\SERVICES.EXE - 0b83cb1a0a4c4124e53bebb50ea9f25c3b318d7f68b216f644c481f71b6b4e80
C:\Users\analyst\AppData\Local\Temp\~DFA3CFEF1806B48103.TMP - 125ca2ca62dc442ca9c0894c9aa363788a1017675179d0d56ba0fe1ee7fd843a
C:\Windows\120.0.0.1.htm - 51afb4216ef0d5692026915fa508bbe1d85c2ee24485b2d2bdf0535b6f32ba8c
C:\Users\analyst\AppData\Local\Temp\~DF9AD053653989B12C.TMP - 9be678f849009c5ec21a617f269a1627ba10a141ac4c4d1b7233d7c34c1acad1
C:\Users\analyst\Local Settings\Application Data\csrss.exe - d3816c1d933caefd630fc4d30f41ac00e62c47ee6b1ca00a8381600597439b5f
C:\Windows\System32\OEMLOGO.BMP - eb79555170611879e79b4cdba59bdf679e63df9d7927d01354e5cf859274c58c
C:\Explorer\msvbvm60.dll - 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
C:\LaunchU3analyst.exe - 130c18315eb771de3f145747e5aa4fffdcf6cb1022363538f0efd85dda6abfb7
C:\Windows\WlNLOGON.EXE - 25804393b74ce0d1d01bbb546a9d5b7467713ae0d3b70655f06f107a8abb258a
C:\Windows\System32\Drivers\etc\hosts - 94c286dff0e7fc3130d875397bc16fe9e81f3e01646dc0047327b4a9e042b418
C:\Users\analyst\AppData\Local\Temp\~DFA7CBFBEE7DC886A0.TMP - a14eff0c48ec4091d4c53084af3da8d36e8958bef573b2146c481ae9466268e2
C:\Depkominfo_Didefaced.htm - 30aa71789cdba1395de5f1c0e38ab2c225e496172dc6d1a8d5547b2fbedbfa19
C:\Users\analyst\Local Settings\Application Data\WINDOWS\CSRSS.EXE - 6900a467ef72d49da97df9626697134670d91cd079071c2157676a6aef920ebd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787938275&P2=404&P3=2&P4=KZJGExyGnD30W6vqarbDWf7%2bJ9wMm2qYtCTBTSVZAsMN1qD4iPtjfHdRFthmAUanBYScL%2bp7HNqjtlOAFcYUmQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787938386&P2=404&P3=2&P4=eIsrukun2FyOAtGQcNX838mIZfjkUAUrXvU5wYoRfaZwNSyWvA3dN8Mjof9ZuzQ3ytHG7BFFceB8MK6g%2bOsGMQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.89.1.13
4.247.188.224
4.230.171.124
20.42.179.204
4.144.132.114
74.178.76.128
20.184.175.12
135.232.92.97
135.232.92.137
20.231.239.246
52.123.129.14
52.123.128.14
40.84.85.40
4.150.223.96
135.233.45.222
203.26.79.13
52.148.114.188
51.132.193.104
52.110.12.20
52.110.12.48
135.232.92.34
52.123.252.194
72.145.35.101
135.233.95.80
52.110.12.42

File paths

C:\\go
D:\\u

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report