MALICIOUS — d4195ee940b118c7608b7c8d5b4e9a8c517b0ab6f0664078312002028e051ed0

MALICIOUS — d4195ee940b118c7608b7c8d5b4e9a8c517b0ab6f0664078312002028e051ed0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: d4195ee940b118c7608b7c8d5b4e9a8c517b0ab6f0664078312002028e051ed0
SHA-1: 0859731d62393e6056e894df767ba9d56e9cdbe6
MD5: c39a77f34a2615e086f91bf638394e9e
imphash: 0a5b71014bc151e12a17149b76079a38
ssdeep: 24576:/rRoNk7BZpf+h/7dym9Y8nOX+ENpvFjvBCC8a7uoqbA6Y242:/rRokpf+Cm9Y8nhETvFrqxEI4
TLSH: T11457BFCA712B6305CD7B87406DE02E4E9093BF546ABD658E934FD01E12DBC27A85D02B
Submitted as: d4195ee940b118c7608b7c8d5b4e9a8c517b0ab6f0664078312002028e051ed0
File type: pe · Size: 1482752 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (4 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

70169 behavior events · 2 ATT&CK techniques · 31 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - 728b8f3702a0ef61069853dccb8645b06d4d6e04d5d7017b95492ef335e6e260
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_54359052731E413C60F1C59EABAD4E05 - d5df7a8a4521fcae423ae6bf2f7b41b857416ac4369cdd91dac4e30cd321ead8
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db - bf10e54e7d5494e7dd941cc33c8b2feb4f815c37d2e7e8bc88c5b3d9ae06a65d
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db - 7f4e824fc48443e0eba51bc4f486297952ee474067140ad9cb51ef51d4742e6d
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 - 2f6837ee442975be4aeeeadd8576af2bf8feb33b6924ff9144fb500cfbced438
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 - a582eb9a0a0d65bb0b4175d1e60ea1b2648d9783657f0124796de7b89939efa8
C:\Users\analyst\AppData\Local\Temp\Tmp6E48.tmp - 07f5485853eb44db90bd99d7c7328dd3d23e83ab09d7a0a88c2f703d92fb7c53
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A - f28b1bde05e86d244139c5c699523d2a045cfe43c32b3834850399f56fffcaab
C:\Windows\Temp\ArmReport.ini - 5016d37c747967c80842fead8e12767cf6abcbce47a88bb5ad9f13c2b1600faa
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - 52cde4f354b8eab4976ceba25b58cbd7efcdf7ccc3871bfe9d9d040850e84d33
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB - 864f182640004c5f297e2eed4c582785b907817266b345fe1003a87b6a832322
C:\Users\analyst\AppData\Local\Temp\{e8660bef-6ef9-4fb5-bf8a-0d5f8df14a23}.png - f3335e652639a387b7532280039027c9102a7da2b28ce72b336c4634b002c768
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db - 4c29c49f61b99fd6f7de2159561ebc7cf5b1917eb155d27b694490a6fe7e1859
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A - c5f1b344dfb46174b00827215ecf4039352062c14d1dc71b0c33b5662740d3ac
C:\Users\analyst\AppData\Local\Temp\Tmp3E2E.tmp - aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b

Embedded URLs

https://armmf.adobe.com/arm-manifests/win/
http://www.adobe.com/support/downloads/product.jsp?product=1&platform=Windows
http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
http://www.symauth.com/cps09
http://evcs-crl.ws.symantec.com/evcs.crl0
http://evcs-aia.ws.symantec.com/evcs.cer0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

armmf.adobe.com
www.adobe.com
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
www.eyuyan.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.7.2.0
20.42.65.90
52.230.59.222
4.230.171.124
172.178.240.163
52.110.12.54
52.110.12.15
52.110.12.49
172.178.240.161
52.110.12.45
162.159.142.9
135.234.160.246
20.60.225.129
48.211.4.16
135.233.45.222
52.148.114.188
40.84.97.4
72.153.5.62

Registry keys

HKEY_CLASSES_ROOT\Software\Adobe\Acrobat\Exe
HKLM\SOFTWARE\RegisteredApplications

File paths

f:\CB\ARM_Sustaining\BuildResults\bin\Win32\Release\AdobeARMHelper.pdb
X:\:`:
X:\:`:d:h:l:p:@;D;H;L;P;T;X;\;`;
X:\:`:d:h:p:t:x:
X:\:`:d:h:l:p:t:x:
T:\:h:
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filetxt.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report