MALICIOUS — d37e89dd72adbc9f1e08481222440e836894e14758094cbd90fa0d1cf5e8955b

MALICIOUS — d37e89dd72adbc9f1e08481222440e836894e14758094cbd90fa0d1cf5e8955b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: d37e89dd72adbc9f1e08481222440e836894e14758094cbd90fa0d1cf5e8955b
SHA-1: 794bbb06030a397d94198d87811e84961a8c061b
MD5: 2fff407c7166192ff4062b44abb5e8e5
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE5uEGOivIQ8Yc7DWudadn0flpsmkh7lCk0VVtFsYr/MYmJ:8u+LIIX7gEGOivL5c7DWyadn0flpsmkt
TLSH: T120575CAD49377262CA3F63E0CD509D0E88286975933F174C93F6781E13C3A2716A7A25
Submitted as: d37e89dd72adbc9f1e08481222440e836894e14758094cbd90fa0d1cf5e8955b
File type: pe · Size: 1507059 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Phobos.154 (rule Gen:Variant.Ransom.Phobos.154) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Scar.gen (rule HEUR:Trojan.Win32.Scar.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

103681 behavior events · 3 ATT&CK techniques · 14 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\LFIZR - 951dee16f40fa1f1331f68aac78fbd861b90047a2b4f790852abec475b59218d
C:\Users\analyst\AppData\Local\Temp\tsk_92848a039c1e4e57.exe - dc1ba9cb15d0808dc2d80ce13acfa0b07acdfcfe2cdf94da47e0e570e7345f6d
C:\Python3\Lib\venv\scripts\nt\python.exe - c94a422a1f343d13dfa9713e8851871b2524a0c67d08fa6533b9072db6c2e18c
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t64.exe - 409648376ddfa127c046ff668b6db0f6a26541a16b4d021c06faeca80fccbb17
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w32.exe - 6d34adafc958a3ce98a2047801c5dab6c59d198c1c152c187363f2b36e51acd9
C:\Python3\Lib\venv\scripts\nt\pythonw.exe - 9bd912cdd2306e4483af98b75a7904daac2ad61b7879ae3d25aa9d1ded8158e4
C:\Python3\Lib\site-packages\pip\_vendor\distlib\t32.exe - 32d0d6694e02fb6b2cc7a4b25e99117e014ea9946ece7c578558720123fefbea
C:\Users\Public\Microsoft Build\Isass.exe - 831762e51895407f6c462adf65077fb21a9191d0cece0f10411a085368e19532
C:\Users\analyst\AppData\Local\Temp\YWZBZ - 27c6328f3592e9d34da7fbd341db58863ebc60e8a39eb9a1deea9b8d593a1ed6
C:\Python3\python.exe - 7a41c164669f6b1b673608a5e223a9f5fa654a2e48c7bebf2d8ef4271e4263e9
C:\Python3\Lib\site-packages\pip\_vendor\distlib\w64.exe - bdd7d2ce23b12a54d7e948d75ccd007907a58736963f4d521cb602300d6ea866
C:\Python3\pythonw.exe - 78308077633e2ad7305af6de00e92633d819f3b0030bb337432e932a2648164a
C:\Users\analyst\AppData\Local\Temp\FAXKO - a27e4fe4140797d50c19ba963d4076400fce5fea3faffe184b984da930378c9f
7fdd21b203a244f7b47743651a9956dc9cc0ec26a549493d720bc73891829f22 - 7fdd21b203a244f7b47743651a9956dc9cc0ec26a549493d720bc73891829f22

Embedded URLs

http://http.proxy.icq.com/hello
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

http.proxy.icq.com
login.icq.com
crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

0.0.0.1
20.184.175.5
52.253.84.76
52.123.252.245
4.230.171.124
20.42.179.192
52.168.117.174
52.110.12.18
52.110.12.26
4.247.188.224
172.178.240.163
92.223.78.30
52.148.114.188
72.145.35.96
52.110.12.11

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report