MALICIOUS — 99147cb03784a3754185947e00f5ee276323bc926392595ebb5d68a8d6b617c5

MALICIOUS — 99147cb03784a3754185947e00f5ee276323bc926392595ebb5d68a8d6b617c5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the HUILoader family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 99147cb03784a3754185947e00f5ee276323bc926392595ebb5d68a8d6b617c5
SHA-1: 6a462f7560293537cc6c7cdf7362b7460e8d2d2e
MD5: a9864d462a0e7da4d9a7f1e20dabe3bc
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 24576:TwSV7kgu1LZbzxnx2Xt/dH739x6dvUoaGb:ESVTu1Dk739sd3
TLSH: T1D854AE89B98AE384E7ECDB287C40298C922BF261517D294D3B87D03D6243C77B57125E
Submitted as: 99147cb03784a3754185947e00f5ee276323bc926392595ebb5d68a8d6b617c5
File type: pe · Size: 1176224 bytes
Verdict: malicious (100/100) · Family: HUILoader

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.ev (rule Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://secure.comodo.net/CPS0C, https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

70070 behavior events · 2 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.exe - 2c68fc8d419c2426bc01eeadb18518cbeb410c2f142e96dfe2730d02c9e5ee85
C:\Program Files\7-Zip\7zG.exe.exe - 2f681e0216c71c4b3b96eebf561b08cb09a37c86969688af5d1820acd8e3e8c1
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
d7d7367000d7008f1aaae6d6fe0e02879251526be77657da055b8d926998073f - d7d7367000d7008f1aaae6d6fe0e02879251526be77657da055b8d926998073f
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - 0b02a41f74e9717e0c1c1b7b037c96e3acfae0791100dc1fc0003774e05a0860
C:\Program Files\7-Zip\7z.exe - d127abeffcf02495452f5f6b703c175cf607ed3b9edfa25fa5dd7d619c121f1e
C:\Program Files\7-Zip\Uninstall.exe.exe - 0c1e5ee585f0104b2c7c46a2ffbbcde91f1382f3c7e6bef6f500b2eb99e55a98
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 9d2c1260561ee5a218ece66ab6a758d345251226998d60c3b7f2997040b2215d
19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b - 19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - ceed7ff3308d4b4f82a1371438cc21968400cf346299e59f5abf206e341ac175
C:\Users\analyst\AppData\Local\Temp\tsk_d918291be22342ec.exe.exe - fa294dc012895f0ef4798803121bb970cc426859783ce574cc29087c1ea658e8
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe.ico - 14b347748c4d208fa5294f7bdd53ae4147d40e27cf810dd60423af0d8b0c989c
d7964913875239187b5176968b381aa5ae0095eebd73d9728228e9671b553116 - d7964913875239187b5176968b381aa5ae0095eebd73d9728228e9671b553116
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.ico - 463b6e99198762de39ea3c9156504527673355f452c17063d0fcc34caa3cfded

Embedded URLs

http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
https://secure.comodo.net/CPS0C
http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
secure.comodo.net
crl.comodoca.com
crt.comodoca.com
d.symcb.com
s.symcb.com
www.eyuyan.com
wtqq.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.114
4.155.93.171
52.123.252.204
4.230.171.124
104.18.33.89
135.232.92.97
20.165.94.63
85.210.196.11
20.184.175.13
20.42.65.94
20.42.73.24
52.178.17.232
52.110.12.14
40.84.97.4
135.234.160.245
52.148.114.188
52.110.12.32
72.145.35.97

File paths

D:\Projects\WinRAR\rar\build\unrar32\Release\UnRAR.pdb
T:\:d:l:t:
P:\:

More HUILoader samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report