MALICIOUS — 317c687d6ee095011de7a0519355f4e5a0353f70ec7228bd0df7418b59d21d16
MALICIOUS — 317c687d6ee095011de7a0519355f4e5a0353f70ec7228bd0df7418b59d21d16 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
317c687d6ee095011de7a0519355f4e5a0353f70ec7228bd0df7418b59d21d16 - SHA-1:
0bd6dbece9e30dc40807f1c39025445c26f270a3 - MD5:
03ba17d8fb2e06cf4b9f640074ac9b22 - imphash:
aae410db5a351d384de2e35faf59497e - ssdeep:
6144:rajdMJyFRe6azHqTGXHaeaEUwoizbuUVfXQW/yX8rp/mRTCI:E2JylsKTUH1oizbuCfTRmh - TLSH:
T17D497C79562B7707EAF7CA1824145EED0022B46D10BB5ACC43D3E13ED2F9E3B59A0198 - Submitted as: 317c687d6ee095011de7a0519355f4e5a0353f70ec7228bd0df7418b59d21d16
- File type: pe · Size: 416200 bytes
- Verdict: malicious (100/100) · Family: Lmir
Detections (7 of 56 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Lmir-22
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Virus:Win32/Viking.MR
- Emsisoft (Emergency Kit): Dropped:Generic.Delf.Lmir.2EC949F5
- Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 18 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule
Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Microsoft Defender flagged Virus:Win32/Viking.MR (rule
Virus:Win32/Viking.MR) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Dropped:Generic.Delf.Lmir.2EC949F5 (rule
Dropped:Generic.Delf.Lmir.2EC949F5) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.gen (rule
Trojan-GameThief.Win32.Lmir.gen) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 3 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: 6.0.1.0 - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
44687 behavior events · 2 ATT&CK techniques · 58 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 252.0.0.224.in-addr.arpa.
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- odc.officeapps.live.com
- www.msn.com
- www.bing.com
- assets.msn.com
Dropped files
- C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe -
b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68 - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe -
377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\LibreOffice\program\gengal.exe -
88243ad70e7c7c3fe0eba4dbfa0c633d503b61d3a191d015fb7b739d1df6e77d - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe -
8f5d54987cb8cb27519acec16a60c79aa1d2b334ee2d26a739a43b551e71523e - C:\Program Files\Adobe\Acrobat DC\Acrobat\CPInstCU.exe -
5b3fa0f5c3d599300a1ad8a22769f2e62b65489f2508aee2541447a65181fae3 - C:\Program Files\Google\Chrome\Application\chrome.exe -
8c17ebeed209393a3cd7eaea639938447d47bed403f19ecff5ff6e4d3f630ba7 - C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe -
f35b0140cc7701a78844f145a508fe8ff0f6e38eef8607f89c3326ec20d97a64 - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe -
44c4b906779cb6f6c8f289e34c331faad1ea5674f3342bb978379c56b65e6997 - C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe -
698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac - C:\Windows\SOS.exe -
1d2e4c049c0e40e25762a0506eb6984eadebfcd4cf15726ecf5f84f8cc7f46d6 - C:\Program Files\Google\Chrome\Application\151.0.7922.174\os_update_handler.exe -
1d4e32e4870e0af3e0fa0e82f53068b747f91bada6d1fc5c4bd9596e1f83be04 - C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe -
2c92f830d0ecb17ffe9718416b9d18e6abca8ba1b40a68472c4112e315120e1a - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe -
edda2106f400826600e73305a9d243ff5895ea20aedc474ab6260fe1e4c7e51c - C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe -
2768f3bb969e61f4383e37497d4b8afddeb9135e30597e76ca7be46eec380fd7
Embedded URLs
- http://msdl.microsoft.com/download/symbols
- http://www.microsoft.com/msdownload/platformsdk/sdkupdate/psdkredist.htm
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788012369&P2=404&P3=2&P4=Ixc%2fvB08dQx5W4B4u0VrCWSuRetU058%2bPjucfRe6R5Lw2es2MVig74PiXx4D%2beslLHaQLwexohb7NDFYXCFcFg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- msdl.microsoft.com
- www.microsoft.com
- crl.microsoft.com
Embedded IP addresses
- 6.0.1.0
- 52.168.117.171
- 52.230.60.54
- 4.230.171.124
- 52.123.252.194
- 74.178.232.29
- 203.26.79.13
- 52.110.12.28
- 52.110.12.1
- 40.84.97.4
- 52.148.114.188
- 72.154.7.103
- 52.110.12.52
- 52.110.12.4
File paths
- X:\:`:d:h:l:p:t:x:
- P:\Target\x86\ship\setupexe\x-none\setup.pdb
More Lmir samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report