MALICIOUS — eacc43d1cae3e2b9e1ba82cad67ef23856939d24425770492fda359dd3fdb9b2

MALICIOUS — eacc43d1cae3e2b9e1ba82cad67ef23856939d24425770492fda359dd3fdb9b2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: eacc43d1cae3e2b9e1ba82cad67ef23856939d24425770492fda359dd3fdb9b2
SHA-1: 075a47d33ad339e0559d341b96c12e84313801b7
MD5: b007042a14acaefd40f2c702903d40b5
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE56DqWc5GkYGzbvtiyM:8u+LIIX70Dq6kzbvhM
TLSH: T1FC529E7A1A3FB253C53BD22409006FED05E6A89E70BD908C9363886E67DBC6719C751C
Submitted as: eacc43d1cae3e2b9e1ba82cad67ef23856939d24425770492fda359dd3fdb9b2
File type: pe · Size: 930286 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9831452-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9831452-0 (rule Win.Malware.Generickdz-9831452-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 19 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

85195 behavior events · 3 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - f2edcae6e22d1aa0832eb57c0a7a41c9971b44acb9809365c76e21b797767869
C:\Sysmon64.exe - 8be8f5ca53f69fb4bfa41c2bb953f1da7d0092a6c07f470e5d8bd45dec56c147
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - d03ffb291f8b1cc478ea76c7ee9bfb642ba6c44f04403f32d24d8bc1347db1b4
C:\Users\analyst\AppData\Local\Temp\ZHHNJ - 9f79443007dac54b548672517f288638086e43765b19c65e73aab11ad002a933
C:\ThreatLens\agent.exe - 9b4f08350eabfef95a85be68586c502c7486408835b854fd28e47f1b356f8129
C:\Users\Public\Microsoft Build\Isass.exe - 1a93d32e8375c76b64454405de4b5d1854fa1eb5db5d58fa5c403edb51256773
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 43035aa174ab9527c36553751ebcb70e6c3157b7d614114011b81375aeabccea
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 966fa0329054d042d3454f89ec4083ad00ed56f3bdfb134280c89823f8c743bf
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 278d59101fa80ccec7bc18274a19a436f21f5a690568533c0244d866f3706b50

Embedded URLs

http://http.proxy.icq.com/hello
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787797884&P2=404&P3=2&P4=DqAdJDaT4a%2bIqmkfyGnS%2fxFTRxvQNcjkJ9s%2f11wYgZIolI7QigK0aVXr2SX7jOgjOOsKdGgnqRY72aXX6qF8HQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787798002&P2=404&P3=2&P4=OxrCHUuaw0JdZTpvNA4tq0UMJU0GjVf5V%2bUAIjGUU35iX50nRibv88MTksu7kin5aO7khj7RShptq6Nl5QMV4Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

http.proxy.icq.com
login.icq.com

Embedded IP addresses

0.0.0.1
20.184.175.15
52.230.60.54
4.230.171.124
4.247.188.233
74.178.240.61
4.150.223.105
135.232.92.97
20.76.201.171
52.123.128.14
40.103.64.242
52.123.129.14
52.168.117.175
172.178.240.161
203.26.79.13
52.148.114.188
20.165.94.46
72.154.7.100
52.110.12.56
52.110.12.33

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report