MALICIOUS — 2798f7a80cda700364c4a95e435b6ed1600089fa0485f864ce2014d373a60cb6

MALICIOUS — 2798f7a80cda700364c4a95e435b6ed1600089fa0485f864ce2014d373a60cb6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 2798f7a80cda700364c4a95e435b6ed1600089fa0485f864ce2014d373a60cb6
SHA-1: 25a6cccdbd9fdae9873fedd279350423b00332b9
MD5: 1a8a6aaf26e4649367a01c31800c0ebc
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:AajdMJb6SqIqOq2eJCdlCgyVQr1wonNQCI5PpFuZ/vTL9+6NkaC5DbC9:92JbM2yYl9yqBN45Ppi/
TLSH: T1E7496CEE462F3313D6F7C52828104AEE4016F4A9217D7ACC5A13D27E82E6C37AD71199
Submitted as: 2798f7a80cda700364c4a95e435b6ed1600089fa0485f864ce2014d373a60cb6
File type: pe · Size: 393314 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (7 of 56 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Kaspersky (KVRT): Trojan.Win32.Patched.rv
Microsoft Defender: Virus:Win32/Viking!atmnm
Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
Trellix Stinger (McAfee): PWS-FCMH!1A8A6AAF26E4

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Kaspersky (KVRT) flagged Trojan.Win32.Patched.rv (rule Trojan.Win32.Patched.rv) - engine signal, weight 0.55, confidence 0.85
Microsoft Defender flagged Virus:Win32/Viking!atmnm (rule Virus:Win32/Viking!atmnm) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Delf.Lmir.CE051F6F (rule GenPack:Generic.Delf.Lmir.CE051F6F) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWS-FCMH!1A8A6AAF26E4 (rule PWS-FCMH!1A8A6AAF26E4) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

40235 behavior events · 2 ATT&CK techniques · 59 dropped files.

Dropped files

C:\Program Files\7-Zip\7z.exe - cddac674d7b58bdc8de1a0939054eb85d81fa4eee18fa8bef569832e37a9f47b
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - e0b630dfc1ea0505665679aa0aef788aaab6badadc36d152f804b06f4af63cd0
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe - f690dbea96c4002484f79cb44963f0c1822565bf08dd894b7d7d9bd2774812c8
C:\Program Files\LibreOffice\program\gengal.exe - 24753f9cd62710031bb1adb382d866b2672fdc3922e51f16e7806f50206ca3bc
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - b038a358fd2c1c514f8800c3a59da756d49e21139cd3c2b93b8879422a86298b
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - f1fe55eea7b0d37b8deee75f0c583f7702100ca26dd432001cf9c500a13b42de
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 03519e01f8877a1b6eb42ad076e6b7ac756f5f991d6136df25608ece3bdfeb47
C:\Program Files\Google\Chrome\Application\151.0.7922.174\Installer\setup.exe - 692ea3fb4f9b703d17a7919ffecb22e07f7ef67689d4d6bfc7a2d4a523a92cd4
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - a5be2ca64e654115c4b4e9565e01d5394c02a674fa8e12e0b16fd7ceb1d28fe4
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b
C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevated_tracing_service.exe - 039f8ab7563c15c15b6e07e6ddcf6787a6bf04daf17507b90ab6bed22518bb6b

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.50.73.5
52.123.252.212
4.230.171.124
57.154.63.210
4.247.188.224
20.247.184.142
74.178.240.51
52.168.117.175
74.178.76.128
74.179.77.204
172.64.154.167
52.110.12.15
52.110.12.48
4.150.223.100
4.150.223.110
72.145.35.108
52.148.114.188
52.110.12.14

File paths

X:\:`:d:r:
J:\:
L:\:l:
X:\:`:d:h:l:p:t:x:
d:\office\source\util\threadpool\src\init.cpp
d:\office\source\util\threadpool\inc\threadpool.h
d:\office\source\util\threadpool\src\threadpool.cpp
d:\office\source\util\threadpool\src\primitives.cpp
d:\office\source\util\threadpool\inc\sharedlock.h
d:\office\source\util\threadpool\src\sharedlock.cpp
d:\office\source\util\threadpool\src\misc.cpp
d:\office\source\util\threadpool\src\waiterthread.cpp
d:\office\source\util\threadpool\src\work.cpp
d:\office\source\util\threadpool\src\threadres.cpp
d:\office\source\util\threadpool\src\timerobj.cpp
d:\office\source\util\threadpool\src\idle.cpp
d:\office\source\util\threadpool\src\workerqueue.cpp
d:\office\source\util\threadpool\src\power.cpp

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report