MALICIOUS — 0c8928ddda1d6431f0f5f6ecdea8850b0d9fc55b0d7a2496f717eb24468ea601

MALICIOUS — 0c8928ddda1d6431f0f5f6ecdea8850b0d9fc55b0d7a2496f717eb24468ea601 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 8 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 0c8928ddda1d6431f0f5f6ecdea8850b0d9fc55b0d7a2496f717eb24468ea601
SHA-1: 61e1387006d74b39e0ceadfd4d61ee884e0a7c40
MD5: 6301a848791948b4774a22dd673a5c1c
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:AajdMJb6SqIqOq2eJCdlCgyVQr1j+SKC4UP49Fqf1lM1ktolIXBxo8gIFf11zG3:92JbM2yYl9yqiSD4UP4w7oyXnZgS1M3
TLSH: T1D74A8EBB0A4E2B4FD77B8A157405A79E1431B8D6907D18C82193873EE3EFC9B891025D
Submitted as: 0c8928ddda1d6431f0f5f6ecdea8850b0d9fc55b0d7a2496f717eb24468ea601
File type: pe · Size: 432284 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (8 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Virus:Win32/Viking!atmnm
Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
Trellix Stinger (McAfee): PWS-FCMH!6301A8487919
Kaspersky (KVRT): Trojan.Win32.Patched.rv

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking!atmnm (rule Virus:Win32/Viking!atmnm) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Delf.Lmir.CE051F6F (rule GenPack:Generic.Delf.Lmir.CE051F6F) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWS-FCMH!6301A8487919 (rule PWS-FCMH!6301A8487919) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Patched.rv (rule Trojan.Win32.Patched.rv) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://stackoverflow.com/a/15281070/18475, http://stanislavs.org/stopping-command-line-applications-programatically-with-ctrl-c-events-from-net/ - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

40498 behavior events · 2 ATT&CK techniques · 58 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 474834c9a38281c61d701f16797e9c2ddfe8093a38a21b834ba17bff1e4e86ea
C:\Windows\GOG.exe - 00ecfec849c4d98b2aa64ef409acb6bd21029474b2eb263b1269b394fa45fe33
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - 9084c6389b366e29f7ba82a5f3c40bb4c93761c555725acd7de77eac3ec12798
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - 7de9f1706ac0f48c4e49f691cf57d51461cd185cad2d096b5667f5e541af9689
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - 33820cb62067075b7e9a5c0f92502163014315f4ef71e1f2d0c3df1b6712710e
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - 4694f915d4a286999accdcadc93a065cb1d47780113a5fb781040450299f7541
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - fe7c9773d50eb4af867bc90e4083fb754cb84992fda241ebfe4a049b0c6a9efa
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Program Files\7-Zip\Uninstall.exe - 39bbaaf98492e3b9b3c87fb15dcc479af91b6f85937681645be3873b08274a03
C:\Users\analyst\AppData\Local\Temp\tsk_863fc18e98714141.tmp - 426ace19debaba6f262dcd3ce429dc8fc0b233f3fa02262375c4641d9f466709
C:\Program Files\7-Zip\7z.exe - 5001e80d2303db020f6943fae888ac5532ca428a375dac73cf6495be748d44c7
C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - 772f7acb7a1a09c45e92ce250eb44fc4448c5d0cc2def8215ff744cf9518a1b0

Embedded URLs

http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://office.microsoft.com
http://msdn.microsoft.com/en-us/library/windows/desktop/ms681388
http://msdn.microsoft.com/en-us/library/windows/desktop/ms681383
https://gist.github.com/jvshahid/6fb2f91fa7fb1db23599
http://stackoverflow.com/a/15281070/18475
http://stanislavs.org/stopping-command-line-applications-programatically-with-ctrl-c-events-from-net/
http://www.w3.org/2001/XMLSchema-instance
https://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-cs-g1.crl05
http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
http://www.digicert.com/ssl-cps-repository.htm0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
msdn.microsoft.com
gist.github.com
stackoverflow.com
stanislavs.org
www.w3.org
shim.app
shimgenerator.app
cacerts.digicert.com
crl4.digicert.com
crl3.digicert.com
www.digicert.com

Embedded IP addresses

40.79.167.9
52.230.60.54
4.230.171.124
20.165.94.54
52.230.59.222
135.232.92.137
4.150.223.112
85.210.196.11
13.69.116.105
72.154.7.114
92.223.78.30
52.148.114.188
52.110.12.37
52.110.12.3

File paths

X:\:`:d:r:
J:\:
L:\:l:
X:\:`:d:h:l:p:t:x:
t:\licensing\x86\ship\0\ospprearm.pdb
c:\borrar\EmptyDll\Release\EmptyDll.pdb

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report