MALICIOUS — accde5905df061d197e1d1ac1be2e95ebf21d91abc9bc5ecb36fb12c70aca8c3

MALICIOUS — accde5905df061d197e1d1ac1be2e95ebf21d91abc9bc5ecb36fb12c70aca8c3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: accde5905df061d197e1d1ac1be2e95ebf21d91abc9bc5ecb36fb12c70aca8c3
• SHA-1: 314581ac5e12fb6bb2ad4a03b4ddb10daaec0bfd
• MD5: 5bacb10ea4677e8c905eeca0ed78b0b2
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 12288:HQjbWgr6oC8InlTEy2E1bZDyeC1McmgiGRy+IUnQEL3w5ieBh:Hdloy2EKg5dGRyuQRVB
• TLSH: T17D52AE4DA652F50DD8326F17B5910AEF9604221DF0AF530C6A1FC27A9DA733314A70BA
• Submitted as: accde5905df061d197e1d1ac1be2e95ebf21d91abc9bc5ecb36fb12c70aca8c3
• File type: pe · Size: 917504 bytes
• Verdict: malicious (100/100) · Family: HUILoader

Detections (4 of 56 engines)

• capa (capabilities): capability:collection/keylog
• ClamAV (daily): Win.Trojan.Generic-9907165-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

• T1071.001
• T1056.001
• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1497 - dynamic signal, weight 0.40, confidence 0.75
• LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

23931 behavior events · 2 ATT&CK techniques · 6 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• watson.events.data.microsoft.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Dropped files

• C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_tsk_9fa50e710887_2b87117ed8e73b2e84143e10b9e2803067856794_00000000_11261102-542d-45e6-8b14-cacbde59c4bb\Report.wer - e56ff31913f9c92d57a5efc30a678fc204cd5b28488866b7e9bc0ad8bf96e753
• 8c31ba806e27550ad8c64fbd0673f5df3f160dd57cdb2026e0c5d05d5c49f955 - 8c31ba806e27550ad8c64fbd0673f5df3f160dd57cdb2026e0c5d05d5c49f955
• 79cb0c51e0b2fe901f4778c7bcd3292bc7ebb353da887ac491808abcc6da8868 - 79cb0c51e0b2fe901f4778c7bcd3292bc7ebb353da887ac491808abcc6da8868
• 69e2f286ae2707fa21791526005ef740e72c1ece67f89f956728ff19e434c600 - 69e2f286ae2707fa21791526005ef740e72c1ece67f89f956728ff19e434c600
• f453c47d5128da18ec59ae990ed496e0b11e22cd4043d56c5850c6bc5254ef08 - f453c47d5128da18ec59ae990ed496e0b11e22cd4043d56c5850c6bc5254ef08
• 65f6177a808bfa34750b756e18354bf49d25600bfebcc633da53f9c414134a27 - 65f6177a808bfa34750b756e18354bf49d25600bfebcc633da53f9c414134a27

Embedded URLs

• http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
• http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
• http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
• http://office.microsoft.com/0
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.eyuyan.com
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• crl.microsoft.com
• www.microsoft.com
• office.microsoft.com
• www.eyuyan.com

Embedded IP addresses

• 4.150.223.97
• 52.230.59.222
• 52.123.252.194
• 4.230.171.124
• 172.178.240.163
• 184.84.165.171
• 52.110.12.50
• 52.110.12.32

File paths

• d:\_Bld\10657\7994\Sources\obj\Win32\Release\EvaluationContainer.csproj\Microsoft.Mashup.Container.pdb

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report