MALICIOUS — gmLauncher.exe

MALICIOUS — gmLauncher.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (90/100), attributed to the HUILoader family. 6 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 7a55fcd248ac4e518e4eae744b92155084ee5c1223e1ac2732cbcaae89f69af8
• SHA-1: f86ccd62f417d5215f09bb3d612e533af219d846
• MD5: 6ebffeca338ab5ab40569d8cef187fb6
• imphash: 82a58a44149f3ef874b9edcd09719361
• ssdeep: 24576:jAWxAD/YuDhsOVC0Hh2mFYHtBibS/+sOQ4B6z1VV7fyVHbmSccrNmbo7UPW5QbK:8YNBibH6u2EJMXVT3TGyqYLeIE1Q
• TLSH: T118610AE423D6A205E77AD02BCB01792F1067C5D3C0ED5989C3872A3E15859439A87BFB
• Submitted as: gmLauncher.exe
• File type: pe · Size: 4082400 bytes
• Verdict: malicious (90/100) · Family: HUILoader

Detections (6 of 25 engines)

• YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
• capa (capabilities): capability:collection/keylog
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Trellix/McAfee ATR: ATR_LockBit_Ransomware
• YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
• Kaspersky (KVRT): not-a-virus:HEUR:AdWare.Win32.LoudOffer.gen

MITRE ATT&CK

• T1056.001
• T1055

YARA

• Windows_Injection_Api_Combo

Why this verdict

The malicious score of 90/100 is the fusion of 6 weighted signals:

• Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• YARA: Trellix/McAfee ATR flagged ATR_LockBit_Ransomware (rule ATR_LockBit_Ransomware) - engine signal, weight 0.35, confidence 0.70
• YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://fontawesome.io, http://fontawesome.io/license/, https://store.steampowered.com/app/4000/Garrys_Mod/ - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://fontawesome.io
• http://fontawesome.io/license/
• http://www.w3.org/1999/02/22-rdf-syntax-ns#
• http://ns.adobe.com/xap/1.0/mm/
• http://ns.adobe.com/xap/1.0/sType/ResourceRef#
• http://ns.adobe.com/xap/1.0/
• http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
• https://sectigo.com/CPS0
• http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v
• https://store.steampowered.com/app/4000/Garrys_Mod/
• http://www.indyproject.org/

Embedded domains

• fontawesome.io
• www.w3.org
• ns.adobe.com
• crl.comodoca.com
• crl.sectigo.com
• crt.sectigo.com
• sectigo.com
• crl.usertrust.com
• crt.usertrust.com
• store.steampowered.com
• www.indyproject.org

Embedded IP addresses

• 0.0.0.1

File paths

• X:\:`:d:h:l:
• X:\:`:d:
• X:\:`:d:h:l:p:t:x:
• P:\:`:h:l:p:t:x:
• X:\:`:d:n:r:
• L:\:h:l:t:x:
• N:\:d:i:t:z:
• V:\:`:f:j:p:t:z:~:
• X:\:`:d:h:l:p:
• X:\:`:d:h:l:p:~:
• U:\:f:m:w:~:
• X:\:`:d:h:l:p:t:
• X:\:
• T:\:d:l:t:
• c:\Skins
• C:\Program
• c:\program

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report