MALICIOUS — 175026976f15d47f87e0b8366fbb158aa48bb15a735c395e00167d9c975d90f5

MALICIOUS — 175026976f15d47f87e0b8366fbb158aa48bb15a735c395e00167d9c975d90f5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 175026976f15d47f87e0b8366fbb158aa48bb15a735c395e00167d9c975d90f5
SHA-1: b7508115a891885d07399b7b374a2c99d158e9b1
MD5: 09356918078f24b86e2d81c7302751e1
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:rajdMJyFRe6azHqTGXHaeaEh2dMQR33QTJBSRqP:E2JylsKTUH5QR33w
TLSH: T18D48AE6E062B7747E1FBC66458009F8E8423F9BE107D64CC62D7C52DA3FB867A6A1104
Submitted as: 175026976f15d47f87e0b8366fbb158aa48bb15a735c395e00167d9c975d90f5
File type: pe · Size: 371246 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MR
Emsisoft (Emergency Kit): Dropped:Generic.Delf.Lmir.2EC949F5
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MR (rule Virus:Win32/Viking.MR) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Delf.Lmir.2EC949F5 (rule Dropped:Generic.Delf.Lmir.2EC949F5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.gen (rule Trojan-GameThief.Win32.Lmir.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, https://d.symcb.com/rpa0+ - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

38476 behavior events · 2 ATT&CK techniques · 58 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - f2cc82e9e56d5a24f5c3b4d0d5448ab55b41197675ae431a94ba79449756c1f6
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe - 6687ed6949652a9eb8ff1d195e99cf87d0e33f91ff6726c45137981bf24e6b80
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - d7688330b3b515a299e4c8ef4a212d305fb9f9dca52ec16ad9439c5ba4949a63
C:\Program Files\Google\Chrome\Application\151.0.7922.174\Installer\setup.exe - f2ec7eac253ba4f6870727abb5a34f45c3d22feddf8fea2530dc22da92587b0e
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - 609a71b70f2e12eb6df1076fd27ffc206ab52b5f010aaf1b5cd2b0c82840d94e
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 22b142e3bd16d116bccdd815e0858692d3132f2242943e725ca486146b119f19
C:\Program Files\7-Zip\7z.exe - 97235d224f9d3c14d9e2f61bb9051f0423ba8b19aa156aeec0c57221263190ad
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Program Files\Google\Chrome\Application\chrome.exe - ab8224450cad028f8f4588b47df6e0f873739e1b7e475f7b57cb6375583ba348
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - 81515ee2baab4be51d72b8b79a719ea9039abc4cc97b75a66562fa13b53a7c94
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 649f2c8b117ac7418fd3f224162b64c622128c07b269ccab46b65763f630120c
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 4fa2b5e7306fed33fae833911d3231f05a1d21fffe309e76f2c377b8212d34bf

Embedded URLs

http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
https://d.symcb.com/rpa0+
http://sc.symcb.com/sc.crl0
http://sc.symcb.com/sc.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
d.symcb.com
sc.symcb.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.171
52.123.252.243
4.230.171.124
48.211.4.16
74.178.240.61
20.247.185.124
135.232.92.97
20.42.65.90
172.64.154.167
20.184.175.9
125.56.205.42
125.56.205.17
72.153.5.140
52.148.114.188
52.110.12.20
52.110.12.11

File paths

X:\:`:d:h:l:p:t:x:
F:\CB\11X_MainQ\BuildResults\bin\Release\chrome_wow_helper.pdb

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report