MALICIOUS — 70731f43818f4fb17dcf9802a344f6a44565999763aaa9e2dde2020752b2e654

MALICIOUS — 70731f43818f4fb17dcf9802a344f6a44565999763aaa9e2dde2020752b2e654 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HUILoader family. 5 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 70731f43818f4fb17dcf9802a344f6a44565999763aaa9e2dde2020752b2e654
SHA-1: 4481d1df311809d2f2cd2c19db2e99661ca6e896
MD5: 03928b3a8adc3853c08b90a835485ae6
imphash: 8214fbfab2d94960fbe39ce7bdc9da1c
ssdeep: 24576:iAHnh+eWsN3skA4RV1Hom2KXMmHa/ei3auwjvNTcqpEBPixrrUA5:lh+ZkldoPK8Ya/eqvSvRxEBPiprX
TLSH: T16A55C0D943195E06D4A5FF0058284B5E18F5A0FEB2FAD9E806C2501A6EFFC57B832463
Submitted as: 70731f43818f4fb17dcf9802a344f6a44565999763aaa9e2dde2020752b2e654
File type: pe · Size: 1272320 bytes
Verdict: malicious (99/100) · Family: HUILoader

Detections (5 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): Trojan.Win32.Autoit.dos

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Kaspersky (KVRT) flagged Trojan.Win32.Autoit.dos (rule Trojan.Win32.Autoit.dos) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Extracted CyberGate config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

86411 behavior events · 1 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\XxX.xXx - 2ff5a862307c4e6765a1df2eab7a945e38acb3fb965d54851769ab0fb8eb880f
C:\Users\analyst\AppData\Local\Temp\XX--XX--XX.txt - 13c7bce72b1672232061f9f530cb9600bc195db0e6010a71d5e6e2ba652a9d68
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - 35c929a35529c3ea8fcebdc126cb317426498effeb5f64311e4eab8f642c84d8
C:\Users\analyst\AppData\Local\Temp\UuU.uUu - 19ea72f5c8b2bb66388153526055f33e32ba41fdac707a404a6fd65ac3a6bbc2
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - 4612d39dece4056f88ad7aacecd7ef2b656d3b419dc4ee13762691ab5fef4fd6
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - a427aeb7c1e9bb7173001bf283b8c2340e5a4a559781c6cec9f94195d086a444
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - 84fb7ca45eff6f098f602cca55ba1482dd66d570163f56a257d805c14a7129a2
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - ffd0fe57542046b6b1cf0c265a39fe0958fbeed06aad7dfaeb647e8da6bf3b2b
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db - 73a9b7390a22a676b1a7b1554e2aa7a6e9b582845e2d95cee2d0a21e5c43c7a3
C:\Users\analyst\AppData\Roaming\logs.dat - 51a3fe220229aa3fdddc909e20a4b107e7497320a00792a280a03389f2eacb46
C:\Users\analyst\AppData\Local\Temp\UuU.uUu - d37e4e4e6e121ebe30d3a7504e28e96bd6095075cbeead2ef537841a17d9b9ba
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - f89c6cb4950f6fad325e378fd6414c66877bb5d0c4e12543f03976d54f69d248
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - 8784e619f7950817dd1317308a9eac28be86da6041cc141d6163d4562c5de779
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - cf76424d244e12e6d0848b659c29e5790a57e677288c1a101070aeb2132846c6
C:\Users\analyst\AppData\Local\Temp\XxX.xXx - c5fc5e1027982c96852a0514bb1b4800269fd48e8e1c05e818d321f08774a252

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.79.167.9
4.230.171.124
4.247.188.233
4.144.132.114
74.178.76.54
20.42.65.91
135.232.92.137
74.178.240.61
52.168.117.175
52.110.12.33
52.110.12.52
20.184.175.23
20.42.72.131
52.110.12.4
52.110.12.37
72.153.5.136
92.223.78.30
52.148.114.188

File paths

V:\:`:f:p:z:
T:\:d:l:t:
X:\:`:d:h:l:p:
X:\:`:d:h:l:p:t:x:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report