MALICIOUS — d83695eb114f4f9fe3a253457790fdec0937edfa9c50b66e6104b465a3732cdc

MALICIOUS — d83695eb114f4f9fe3a253457790fdec0937edfa9c50b66e6104b465a3732cdc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: d83695eb114f4f9fe3a253457790fdec0937edfa9c50b66e6104b465a3732cdc
SHA-1: 1c67c4f76323e3dcbf98b69cc470118e83bf0436
MD5: dd30511c782070ac470a90704973c7c4
imphash: 7eb6cca34dfba0a63ae93a9245cf4851
ssdeep: 6144:Nk3fpheTECz8n1zWHkg7H7XYaTesy1vTW:afpheTECzc1Gk8H7XCsy1vTW
TLSH: T18B4412017425D6DFD302E9A82E1EBD6EEE8664ED30B882C41E570DDF245B68B81113F9
Submitted as: d83695eb114f4f9fe3a253457790fdec0937edfa9c50b66e6104b465a3732cdc
File type: pe · Size: 246285 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
ClamAV (daily): Win.Malware.Lethic-6804170-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Zbot!pz
Emsisoft (Emergency Kit): Trojan.GenericKD.32096042
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Lethic-6804170-0 (rule Win.Malware.Lethic-6804170-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Zbot!pz (rule Trojan:Win32/Zbot!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.32096042 (rule Trojan.GenericKD.32096042) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.lol 1 (rule high-entropy-sections:.lol 1) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.lol 1, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hollowing in pythonw.exe (pid 8380) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

2581 behavior events · 1 ATT&CK techniques · 7 dropped files.

Dropped files

C:\ProgramData\Mozilla\pmpnptg.exe - 70a64497bb7976491a7bcc99670b41993fd1e2aaa7b1a5f59de79c73792f0936
C:\ProgramData\Mozilla\hiogahe.dll - 29a93960700bf897994028a4fffc9ac449a54f3e525fafa9f0114a1f724fdf4f
1f37fbf092da1607296093c19779d7771f04b36c66593c4ecf26308ab51e74e8 - 1f37fbf092da1607296093c19779d7771f04b36c66593c4ecf26308ab51e74e8
d73ff3c3eab47708ee3e5693bab18c9c6417d6663e06d98e38151b2d7f2ca058 - d73ff3c3eab47708ee3e5693bab18c9c6417d6663e06d98e38151b2d7f2ca058
70261ed7c785f29719b355e59149f621f0f5a1a64dbe58fcc8172d13cb6c9f11 - 70261ed7c785f29719b355e59149f621f0f5a1a64dbe58fcc8172d13cb6c9f11
ede150bedeef67c8db62cf6cba54101a5a67ca407ca061a9071b73a08a02a63e - ede150bedeef67c8db62cf6cba54101a5a67ca407ca061a9071b73a08a02a63e
da78e6ffd32d40071aaf068cb0012890c46bc503f2dac05b801e1e1ebd362f2c - da78e6ffd32d40071aaf068cb0012890c46bc503f2dac05b801e1e1ebd362f2c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.184.175.21
52.230.59.222
4.230.171.124
172.64.154.167
85.210.196.11
52.110.12.20
52.110.12.54
4.247.188.224
72.145.35.101
52.148.114.188
52.110.12.8
52.110.12.49

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report