MALICIOUS — f5fa339fcc625f6ce80bb9f6136140d32be5d199d4781eb4dc881c916c53dc5f

MALICIOUS — f5fa339fcc625f6ce80bb9f6136140d32be5d199d4781eb4dc881c916c53dc5f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 6 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: f5fa339fcc625f6ce80bb9f6136140d32be5d199d4781eb4dc881c916c53dc5f
SHA-1: 9907b5aa0ef9a3ac28e43109ed94dbf20e2c34b3
MD5: c0a4a135e739e8a8b7e41fb23d2bdc9e
imphash: f5e2fae08fb1c8fba965c988eb10e880
ssdeep: 24576:8uPmLDUMihIXCE5gpJE4VDd+R6ApNc+l7AXDrft+Kk28QvZWmowZ0l:8u+LIIX7SJE4VBJYarQ5QvV0l
TLSH: T14C56D07A66377687F63AE510490737DC4177EC5600FA78898773882CA7EB8B32091729
Submitted as: f5fa339fcc625f6ce80bb9f6136140d32be5d199d4781eb4dc881c916c53dc5f
File type: pe · Size: 1462553 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Generickdz-9832066-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Phobos.154
Kaspersky (KVRT): HEUR:Trojan.Win32.Scar.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Generickdz-9832066-0 (rule Win.Malware.Generickdz-9832066-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://http.proxy.icq.com/hello - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

92359 behavior events · 3 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileCoAuth.exe - 3b0416c59fbc4695e8a8a5cf9406cf39875fa4681d43c1a08cf473f2328c88b2
C:\Users\Public\Microsoft Build\Isass.exe - ae1e0522b41992af0f88960dcb97e8b71e99a7e4796f454e4c8d2ff320d9f99f
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 3c3e79da7395279d0a6faf64dd96d48f3d57e1cddd33020f9d9b21d8d23e695a
C:\ThreatLens\agent.exe - 3d0040c84c9449fe8f2cc4281bcc942d9781249c027ba811f54043bcb67469fd
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 488ba98f71fed1871f3ad2aaf3ecc060f1ed5d3989855afcd58ec02535436478
C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 6a5f0f24d738c1e3f22a9154e99f7ac6179656c87e0a6417628be2f5b003d74d
C:\Sysmon64.exe - 2dc92bedda6340828bb6e812cdee9b58d12b123629da616436cd0a3a1a6fd50a

Embedded URLs

http://http.proxy.icq.com/hello
http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787925233&P2=404&P3=2&P4=jdkOtnMTo7nikKJSW3%2fpvyH3FIh8Q2k4BzXDdGMHCfPC4lU0j7YRdkEIlFMKhdOMg8kmQwTpCVCoaNIKjZUCEQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787925312&P2=404&P3=2&P4=BPUxLe1KUd%2b2DLC0at1Y75pvx%2fy9RHmydOuHWsJ20S10Tf5AW1AB5vP2PAee4G5HIHugpXZA2xZnQIkjwlfaIw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

http.proxy.icq.com
login.icq.com
crl.verisign.com
crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

0.0.0.1
20.184.175.16
40.84.97.4
4.144.132.114
4.230.171.124
85.210.193.152
74.179.77.204
4.150.223.97
52.123.252.238
20.165.94.54
20.112.250.133
52.123.128.14
74.178.240.61
135.234.160.246
203.26.79.13
52.148.114.188
52.123.252.220
135.233.95.80
135.233.45.223
72.145.35.101
52.110.12.54
92.223.78.30

File paths

R:\Sg
X:\:`:d:h:l:p:t:x:
V:\:a:g:r:x:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report