MALICIOUS — b87407511a69c4f9181e75a625ed0a810430f16a43983287acbb4e3f5010858e

MALICIOUS — b87407511a69c4f9181e75a625ed0a810430f16a43983287acbb4e3f5010858e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: b87407511a69c4f9181e75a625ed0a810430f16a43983287acbb4e3f5010858e
SHA-1: fe1ce0dc37b02a80debeb1bede75fbe5701bfa2b
MD5: 6626d03a22ccf463809bbf3699ce281b
imphash: 8fc60686f466ced15548f0a8efb753b8
ssdeep: 24576:+seuZ1SX6WKknviaQoQG4N2DeeU/NdM/hy:+seJ1hb0ghy
TLSH: T1D3547D6B436F7753CE37D62885069F5E1012F8BEA0B518C85EE7882C93F5C772A01629
Submitted as: b87407511a69c4f9181e75a625ed0a810430f16a43983287acbb4e3f5010858e
File type: pe · Size: 1163456 bytes
Verdict: malicious (99/100) · Family: HUILoader

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged
Kaspersky (KVRT): HEUR:Trojan-PSW.Win32.Esgo.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 14 weighted signals:

Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.Win32.Esgo.gen (rule HEUR:Trojan-PSW.Win32.Esgo.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.htcmms.com.tw/gen/Artemis-1.0.xml, http://cardbar.586.la/, https://login0.cardbar.cn/EGEnCodeCenter.asp - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

5405 behavior events · 2 ATT&CK techniques · 13 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - 3c1e960229d563196aefcebf5dae509ab4e2ce200588b926c80c62893de2c5ba
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\9G746KYB\ErrorPageTemplate[1] - 8d018639281b33da8eb3ce0b21d11e1d414e59024c3689f92be8904eb5779b5f
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\NewErrorPageTemplate[1] - 77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\navcancl[1] - bee0439fcf31de76d6e2d7fd377a24a34ac8763d5bf4114da5e1663009e24228
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\info_48[1] - 251fc2ffcdea06426f33dea493c57f1c045aad68a569d61c1a88b3861c7e8bdf
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\9G746KYB\dnserrordiagoff[1] - a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\VB5HMN51\errorPageStrings[2] - a1270e90cea31b46432ec44731bf4400d22b38eb2855326bf934fe8f1b169a4f
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\VB5HMN51\httpErrorPagesScripts[1] - 54c0a29d0f6fba274ceec1e1cc8933c5ef35ebf7d9854fb325f66fa3b162ca8c
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\bullet[1] - 1d8e5fd3c1fd384c0a7507e7283c7fe8f65015e521b84569132a7eabedc9d41d
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\background_gradient[1] - 1471693be91e53c2640fe7baeecbc624530b088444222d93f2815dfce1865d5b
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
e3b99f4f3a29ce380b5d55d26205ecccfa13dfadf9a0bcf192f5095114a7fd35 - e3b99f4f3a29ce380b5d55d26205ecccfa13dfadf9a0bcf192f5095114a7fd35
346e692f580e543c595937d92ae8b1dfe28a2dabd0dea2c8eeded22c39abd011 - 346e692f580e543c595937d92ae8b1dfe28a2dabd0dea2c8eeded22c39abd011

Embedded URLs

http://www.htcmms.com.tw/gen/Artemis-1.0.xml
http://cardbar.586.la/
https://login0.cardbar.cn/EGEnCodeCenter.asp
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://ocsp.wosign.com/ca0
http://aia.wosign.com/wosign.cer0
http://crls.wosign.com/ca.crl0E
http://www.wosign.com/policy/0
http://www.wosign.com/policy/02
http://crls.wosign.com/code-3.crl0w
http://ocsp.wosign.com/class3/code/ca04
http://aia.wosign.com/class3.code.ca.cer0
http://www.wosign.com/0
http://ocsp.startssl.com/ca00
http://aia.startssl.com/certs/ca.crt02
http://crl.startssl.com/sfsca.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl

Embedded domains

www.htcmms.com.tw
login0.cardbar.cn
cardbar.cn
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
ocsp.wosign.com
aia.wosign.com
crls.wosign.com
www.wosign.com
class3.code.ca
ocsp.startssl.com
aia.startssl.com
crl.startssl.com
cardbar.586.la
www1.173zx.cn
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

0.0.0.1
40.79.141.153
4.230.171.124
48.211.4.16
20.247.184.197
74.178.240.61
74.178.240.51
20.42.73.28
4.150.223.112
4.150.223.108
72.153.5.134
52.148.114.188
52.110.12.53
52.110.12.10

File paths

c:\tcp.log
E:\ff\indy9.0.18_0407\IdCoder3to4.pas
E:\ff\SecureBlackbox\Sources\SBClient.pas

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report