MALICIOUS — 448879649f6e11e857d3f172b29b604f52187d2c2d0a487c13dc97821ec50aea
MALICIOUS — 448879649f6e11e857d3f172b29b604f52187d2c2d0a487c13dc97821ec50aea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 8 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
448879649f6e11e857d3f172b29b604f52187d2c2d0a487c13dc97821ec50aea - SHA-1:
82d5b1e5d757c8f698e58196d20f39242e7485f3 - MD5:
12b144b88c87f9efad6a8f4638455e66 - imphash:
aae410db5a351d384de2e35faf59497e - ssdeep:
6144:AajdMJb6SqIqOq2eJCdlCgyVQr1XonNdO+bO+TyiL:92JbM2yYl9yqYNbpXL - TLSH:
T113467C3A177F2A1BC6B6CA0864085F7E4122F4BB107E5ACC5293C12CE3FE8671661259 - Submitted as: 448879649f6e11e857d3f172b29b604f52187d2c2d0a487c13dc97821ec50aea
- File type: pe · Size: 306869 bytes
- Verdict: malicious (100/100) · Family: Lmir
Detections (8 of 56 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Lmir-22
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Virus:Win32/Viking!atmnm
- Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
- Trellix Stinger (McAfee): PWS-FCMH!12B144B88C87
- Kaspersky (KVRT): Trojan.Win32.Patched.rv
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 19 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule
Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Microsoft Defender flagged Virus:Win32/Viking!atmnm (rule
Virus:Win32/Viking!atmnm) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged GenPack:Generic.Delf.Lmir.CE051F6F (rule
GenPack:Generic.Delf.Lmir.CE051F6F) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-FCMH!12B144B88C87 (rule
PWS-FCMH!12B144B88C87) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Patched.rv (rule
Trojan.Win32.Patched.rv) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 14 external host(s) and 11 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.gnu.org/software/coreutils/, http://translationproject.org/team/, http://gnu.org/licenses/gpl.html - static signal, weight 0.35, confidence 0.60
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
64347 behavior events · 2 ATT&CK techniques · 58 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 252.0.0.224.in-addr.arpa.
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- dns.msftncsi.com
- 85.52.40.23.in-addr.arpa.
- nexusrules.officeapps.live.com
- 146.109.171.150.in-addr.arpa.
- v20.events.data.microsoft.com
- c.pki.goog
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- ctldl.windowsupdate.com
- yr.c.lencr.org
- 54.133.221.23.in-addr.arpa.
Dropped files
- C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe -
b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe -
0622bbd6bdd74f7d1a29851dd3dbb4b7dc760422493ad7279d6f37bf2754b6b0 - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe -
377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\7-Zip\Uninstall.exe -
bf1fd2dbcc6208e429bc21dc1b5e9fbd362581b9bb732176339412105d7554f4 - C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe -
c0678dfeca9507a8c9eafc9cbebb4870d1199634e60eae11974e8045f2aad3a0 - C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe -
6eea082dfdc217fd30ce74233e49b47fb01468b408f80b91dea6c32f9804d48e - C:\Program Files\7-Zip\7zG.exe -
2053619ffe67bd91c98f67a525bcaebc1887dc70dd862e62a85eef92a3d08073 - C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe -
14e985027777875db8bacdeaa19d6ce7a5a2d48cd25709d82c2a2eca14b9b65f - C:\Program Files\Google\Chrome\Application\chrome.exe -
a512397a4bf1ec044082446db2a08a73ec5c12324f641a1b7d68f4f2edd3ba6b - C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe -
1f23007ee1f516eddc779ca7d06c1694a2acd5158fbbe12f9575026264dcfd91 - C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe -
698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac - C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe -
de5ed4e50a7b3fb8fd733c5a13eed3091e581bac78fdc3a4d4495e256e982d6a - C:\Program Files\Google\Chrome\Application\151.0.7922.174\os_update_handler.exe -
0b6d1ad76b4dc3bcb64f86f8a543c9daa6d2993346899339cbd461948a6b4569 - C:\Program Files\7-Zip\7z.exe -
c7e7b80bd5104f7f66677879d0afd4dee674380c81f7b5e7b1f4c86c42f1948b
Embedded URLs
- http://msdl.microsoft.com/download/symbols
- http://www.gnu.org/software/coreutils/
- http://translationproject.org/team/
- http://gnu.org/licenses/gpl.html
- http://www.gnu.org/gethelp/
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- msdl.microsoft.com
- www.gnu.org
- translationproject.org
- gnu.org
- cygwin.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ..localmachine
Embedded IP addresses
- 20.42.73.28
- 51.105.71.136
- 20.184.175.16
- 203.26.79.13
- 172.172.255.216
- 72.145.35.97
- 52.148.114.188
- 72.145.35.103
- 72.153.5.131
- 74.178.76.44
- 4.150.223.105
- 72.145.35.96
- 52.168.112.66
- 20.42.73.31
- 20.42.65.94
- 4.150.223.114
- 135.233.45.223
- 20.247.184.142
- 52.123.252.231
- 184.84.165.136
- 4.230.171.124
- 72.153.5.133
File paths
- X:\:`:d:r:
- J:\:
- L:\:l:
- X:\:`:d:h:l:p:t:x:
- g:\Acro_root_atg\Acrobat\Viewer\Win\output\acrobat\AcroRd32Exe.pdb
More Lmir samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report