MALICIOUS — 745ee1a8d97ab31fc2400b4004d2929bff12f466108dc98f9b9d0cf5588ca3f8

MALICIOUS — 745ee1a8d97ab31fc2400b4004d2929bff12f466108dc98f9b9d0cf5588ca3f8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 745ee1a8d97ab31fc2400b4004d2929bff12f466108dc98f9b9d0cf5588ca3f8
SHA-1: d1fc41e34aaee3e1b6c56921dc35c5e2ad662dc8
MD5: 93d144c1c91aa593a6d582f4b5ae89ef
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 12288:8uPUTLYcAaUMhUhLupXshh1PEd5hOoAdUPEjoocrYRNFdi7:8uPmLDUMihIXCE5wUPEjof/
TLSH: T11D50BFBE1B3B7743D977E6280D05AFAD002DB85690BD144CA327843DBBE3C6B1A40569
Submitted as: 745ee1a8d97ab31fc2400b4004d2929bff12f466108dc98f9b9d0cf5588ca3f8
File type: pe · Size: 795191 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 23 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

91954 behavior events · 3 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 888c244fd43fb5d51e218dc462a0ff0677489c82970e4abe17374f9fad72b9f7
C:\ThreatLens\agent.exe - edfe8a43949933a22449a662e46599b6633fae07c4f70bfc3ff75e8235257216
C:\Users\Public\Microsoft Build\Isass.exe - a3f5e6aeb8c48e07c9a023b8b73c96c728ccda3c5b56f8e06764628e5af8a813
C:\Users\analyst\AppData\Local\Temp\LNYSM - 9f79443007dac54b548672517f288638086e43765b19c65e73aab11ad002a933
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 47a3ea61a0b53f8c93fa106e2339b0e93e0e87562d645570b8905823e6ba4468
C:\Sysmon64.exe - dae9f358f776058745caca4608ba7184b7e482c544b5ad6f3663f8bc2eb1a312
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 6ef64ccd17ab24c00cd72c56af623d0c726b6d30151ae25e3f8b70828160ea91
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 647910ff57d7fcb0430a0b2af59e6b7e4dd89d020a37fb906ff91b5cac78b751
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - d767dd4a45d3e58e4a5ccd73bd5ddedea628720fca4e002fa3429318be0c9b1b

Embedded URLs

http://http.proxy.icq.com/hello
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787840182&P2=404&P3=2&P4=HJxM70%2fQ%2baBeRIclaJCIwUYzc3OSOBUN8g4UehsMUzcsmsocDqVOJoz2P84PTJ8SfmphWyVCQDRZtP0ZlvVziQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787840303&P2=404&P3=2&P4=nrUPqNLfxH6MGVvuSyTw2r4RWuAU0N0gskEeVlMoY8WMJwPUkAWFDMnVnXLbE8ajGg9qetmFJW5NP4mEHvLGTg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

http.proxy.icq.com
login.icq.com

Embedded IP addresses

0.0.0.1
4.150.223.99
172.215.188.232
4.230.171.124
20.247.185.124
20.42.179.192
74.178.76.128
20.184.175.0
135.232.92.97
20.236.44.162
52.123.129.14
52.123.128.14
4.150.223.105
135.233.45.222
203.26.79.13
20.42.179.204
52.110.12.14
52.110.12.52
52.148.114.188
52.123.252.203
74.179.71.159
72.145.35.101
52.110.12.49
52.110.12.37

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report