MALICIOUS — afc9739343eb16360952fa30c5502dc17052aff52b4e558d25f643d2f58597e2

MALICIOUS — afc9739343eb16360952fa30c5502dc17052aff52b4e558d25f643d2f58597e2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: afc9739343eb16360952fa30c5502dc17052aff52b4e558d25f643d2f58597e2
SHA-1: ee30e7c2906f9f2e49374a0b8a157bb4beb2f5f2
MD5: 98ba42207a601a97e983c7e7c5d5d473
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE5jpJE4VDd+9/9zpL+LWT2fmRjjxAVa6RT5:8u+LIIX73JE4VBQbbimRjUr
TLSH: T15F57F165066B3947CBB9DE508A467FAD0321783620FD380CA3B7902F66E78B71DD1609
Submitted as: afc9739343eb16360952fa30c5502dc17052aff52b4e558d25f643d2f58597e2
File type: pe · Size: 1507339 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 32 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 9 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

49695 behavior events · 3 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - c932f91bf1ae021c57dfa4c26b381dfb8ca58a8a423a974243c949a50e117390
C:\Users\analyst\AppData\Local\Temp\tsk_5a775be9b9f5456e.exe - 2435e1e50c097608e6157efb1036946cfdd02d86728e8e00a02b207bee36e60d
C:\Users\analyst\AppData\Local\Temp\ECDWH - 9f79443007dac54b548672517f288638086e43765b19c65e73aab11ad002a933
C:\Sysmon64.exe - 79e77c23ff2398b6e3dae2f5f015515d1a8ac22d88c3342966be817f33362239
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - cf6c35204695e45ff06d80f6a48aedebbff782562b98d7c878a26dea276bfa62
C:\Users\Public\Microsoft Build\Isass.exe - 7b61f3ed9c58706144e17c51567d392b1a2d3d55fa0df88e31adcf22429f027b
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - ae5300d2d81bdf0a05d00fb8b27db89978c2aabcc08ab41bbbd280eb420692af
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - 3333dea6e803fa3bc136416236f73d54a3579738e1b8642f856060b99dc0d743
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - f13c1ba30d24bfc27d88b3a2de74644de956b0e880b46ee9412c2ae1bfd2f5aa
C:\Users\analyst\AppData\Local\Temp\dw.log - ae9d151f81571c74877d64a012b23b13c42bbddb057baf31a5f608bade0f1c86
C:\ThreatLens\agent.exe - 2aa089b77a25a4792d97f82743ec898cce8b00e502e9e325f008a52c2fb184fe
00f6bce6c6b8b4016c9f4192eb0a6b2bbd3512b12cc155204d5db02686185a6c - 00f6bce6c6b8b4016c9f4192eb0a6b2bbd3512b12cc155204d5db02686185a6c

Embedded URLs

http://http.proxy.icq.com/hello
http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787814105&P2=404&P3=2&P4=GQ84Sb5BIS8RSBK0J0DwP5CRj0WU3udUbirg3JG9M%2bN%2fTn0H4rP4YBoeByI9lpFzoB8%2fiC4LnyYbNNvriKBHhw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

http.proxy.icq.com
login.icq.com
crl.verisign.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

0.0.0.1
51.116.246.105
4.230.171.124
85.210.196.11
20.247.185.124
20.42.179.192
74.179.77.204
52.182.141.63
40.99.134.18
52.123.128.14
20.231.239.246
52.123.129.14
74.179.77.164
20.42.73.30
135.233.45.221
52.110.12.5
52.110.12.52
52.123.252.215
135.233.45.222
203.26.79.13
52.148.114.188
125.56.205.56
125.56.205.17
52.123.252.194
135.232.92.34

File paths

R:\Sg
X:\:`:d:h:l:p:t:x:
V:\:a:g:r:x:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report