MALICIOUS — 100a881b3c0e2ab7c0eaf8ca002ccd5db745089c358189983a272ca823b164b2

MALICIOUS — 100a881b3c0e2ab7c0eaf8ca002ccd5db745089c358189983a272ca823b164b2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 100a881b3c0e2ab7c0eaf8ca002ccd5db745089c358189983a272ca823b164b2
SHA-1: 44324bd999fd7bae96c5b28a6a11107f29868aa8
MD5: b4cd721848a126c7ced1609b353a904b
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:rajdMJyFRe6azHqTGXHaeaEUwoizK5qcfN2xIDJcuAs9wFACc:E2JylsKTUH1oizkEIJdD9iY
TLSH: T1FA4C6CA4062B9243CA76CD0DAC6049AD4431F429B0B9F05C57D3C43E92F5D3BA9DE2A7
Submitted as: 100a881b3c0e2ab7c0eaf8ca002ccd5db745089c358189983a272ca823b164b2
File type: pe · Size: 525066 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.MR
Emsisoft (Emergency Kit): Dropped:Generic.Delf.Lmir.2EC949F5
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: updater.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 6.0.1.0 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

32271 behavior events · 2 ATT&CK techniques · 51 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - cd8d87fa9fa316f66e409cfc7ca1cad2e01822df8edcf8ac9dcfbd77cc1b8854
C:\Program Files\LibreOffice\program\sweb.exe - b613906c2b437306bc8162e7c2be8884d0a9319cec623e71e763705cacddbe88
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - c41757bfd8a595c5faa71858f3f1bb35aa1b1f1af8cb9b60184fd37bb8c1724f
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\pythonw.exe - 30aebad6a74f805e74eaec0efd14ff5d52e7a755ad014a2c31e9d74a6182cad9
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\smath.exe - c1493f11b02083110ff614813ddbb01f58185285d5e78acce428bc1d06e76e05
C:\Program Files\LibreOffice\program\quickstart.exe - aab643d3aff78ae734b629f7e7f8ece672cca77d1c1def9e5871af933eaeccb8
C:\Program Files\LibreOffice\program\senddoc.exe - b9ae3b92b007ba534d660b8d3ea5e63cadb178fdab5549d9ba945b5c2dbbba2c
C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe - e7b5592f7820e788265ccaf5b55b1d3ec67a04cfd00d47c072a257e43aab3311
C:\Program Files\LibreOffice\program\update_service.exe - e0905ab283e7b6880c3d03b0027cf930812d69cc25628ee6431b00aefd5b8ad2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - f84b7721cebdc839aeb7edbde9e62362f06ad49f7f4bb0f5195ef76e9edd0fbe
C:\Program Files\LibreOffice\program\unoinfo.exe - 0b68cce1f0c3f4c9592ef52560e74f73b9e2c86048ca94f340a4786ab03bf3d8
C:\Users\analyst\AppData\Local\Temp\tsk_f50328c4ac764fd3.tmp - be8a6fd1742f037ee6d25b6dcd87b47be2a2ff15298bf082e1476cea5927be2a
C:\Program Files\LibreOffice\program\sbase.exe - f273463bc7628e16299f461ee836d0d1301a4b694bd0ddd59bc0f8bdae83bccc
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - c29399688495546a77fef1c6ad1504224be1446fc37d65524f9c937b00c669ff

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787930768&P2=404&P3=2&P4=H54JLMsno1APuKY3ih51YhYbz5ZtX8Wl8N2EuA9dF0P5nEVL9wP2sD7jYwbVQ%2bXz8XZqKk1eJwcZcN57hFdbyQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787930837&P2=404&P3=2&P4=e1Ysipf0raMHswVMuRC%2fEUMvkYS4tX7zWJ4BxdvdOwEDbx1ecb7d22BVlWiwcNsSNHuJPxdFBGhbcVBfViy2KA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

6.0.1.0
52.168.112.67
40.84.85.40
20.247.185.124
4.230.171.124
74.178.76.128
4.150.223.105
74.178.76.54
20.112.250.133
40.103.64.242
52.123.129.14
52.123.128.14
52.123.252.213
135.232.92.34
203.26.79.13
135.233.45.221
52.148.114.188
52.110.12.26
52.110.12.19
52.123.252.225
72.145.35.96
52.123.252.241
92.223.78.30
52.110.12.24
52.110.12.52

File paths

X:\:`:d:h:l:p:t:x:
P:\Target\x86\ship\setupexe\x-none\setup.pdb

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report