MALICIOUS — 905ce03a4398e32e5bafd0cbfd230341886f8c526d0ef0f2f6b676316194d433

MALICIOUS — 905ce03a4398e32e5bafd0cbfd230341886f8c526d0ef0f2f6b676316194d433 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 905ce03a4398e32e5bafd0cbfd230341886f8c526d0ef0f2f6b676316194d433
SHA-1: 4513cf77650874fe56e9658eb09e114f6909f23b
MD5: 76a4845918c4d505554a4aa61cfdfea6
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 6144:n8fgjPU6UL0rcAyt8eeMfzghoaGZhGp7A+upa9mv7Ih/hewA+B/uhXd5rvlnOoN6:8uPUTLYcAaUMhUhLupXshh1PEd5hOo4
TLSH: T1F44E9D7E172BB757CA3BD3240D016FAD0466BC66207D244DA367842EF3E7C6B1A40629
Submitted as: 905ce03a4398e32e5bafd0cbfd230341886f8c526d0ef0f2f6b676316194d433
File type: pe · Size: 638976 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in Isass.exe (pid 5376) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Phobos.154 (rule Gen:Variant.Ransom.Phobos.154) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Scar.gen (rule HEUR:Trojan.Win32.Scar.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2839 behavior events · 1 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\FBHTU - 951dee16f40fa1f1331f68aac78fbd861b90047a2b4f790852abec475b59218d
C:\Python3\Lib\venv\scripts\nt\python.exe - 87f6d41ca8058eb3120ac60a040f1ae0d10de2cba9203fdd5eb10aa4934d605b
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w64.exe - 08cdc8d3c0f9336c6025e823240ba6518d702c3a422a4eb6300c8fbf606fc741
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w32.exe - 492ab496cd6588db5702b9cbd4ad88b4897c0d377e88e0aad01565d8aa1a59d7
C:\Python3\Lib\venv\scripts\nt\pythonw.exe - 769d4735612beaf39ba66b3480fb5ad2e853afa442163f4e5da18e1759849282
C:\Users\analyst\AppData\Local\Temp\CCLKD - 27c6328f3592e9d34da7fbd341db58863ebc60e8a39eb9a1deea9b8d593a1ed6
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t64.exe - 807169f6b25953dbec71e7c9060c32ca411073cdade11f0122746682ec5820a8
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t32.exe - 8d0655c9e4550a2c180636e179046197d59de95d9690360c37c16c21ae1b8f29
C:\Users\analyst\AppData\Local\Temp\EIFCY - a27e4fe4140797d50c19ba963d4076400fce5fea3faffe184b984da930378c9f

Embedded URLs

http://http.proxy.icq.com/hello
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

http.proxy.icq.com
login.icq.com

Embedded IP addresses

0.0.0.1
4.150.223.103
20.247.185.124
4.230.171.124
4.150.223.111
52.110.12.10
52.110.12.20
172.215.188.232
72.154.7.96
52.148.114.188
52.110.12.4
52.110.12.1

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report