MALICIOUS — 6a9e1dcf2940dae54a362e431555704d73b110d201f65e8536cf82f54887bb6a

MALICIOUS — 6a9e1dcf2940dae54a362e431555704d73b110d201f65e8536cf82f54887bb6a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 6a9e1dcf2940dae54a362e431555704d73b110d201f65e8536cf82f54887bb6a
SHA-1: a009b46670e7919878ffc05715da12deedb49408
MD5: fa2dcaf0029efb44d5a41019d912e660
imphash: 5124cd999a2e4c567a9a25b581fe72b3
ssdeep: 6144:bvrb22uGLbWhTjYVMUIOIs6qWOIs8AEAwb3yHgvztJ:bDb22DShTEeUInFAEAeJtJ
TLSH: T1EA49AFB79A05EE8FE9F65826E010A36C1A0E94E77C6B384C03C4C05274F5867B47769E
Submitted as: 6a9e1dcf2940dae54a362e431555704d73b110d201f65e8536cf82f54887bb6a
File type: pe · Size: 397018 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (7 of 56 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Lmir-24
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Virus:Win32/Viking.KI
Emsisoft (Emergency Kit): Trojan.Agent.CGVL
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.oa

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-24 (rule Win.Trojan.Lmir-24) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_f1202e401d (pid 5964) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Viking.KI (rule Virus:Win32/Viking.KI) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.CGVL (rule Trojan.Agent.CGVL) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.oa (rule Trojan-GameThief.Win32.Lmir.oa) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://repository.certum.pl/ctnca.cer0@, http://www.certum.pl/CPS0, http://repository.certum.pl/ctnca.cer09 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 55 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

31657 behavior events · 2 ATT&CK techniques · 59 dropped files.

Dropped files

C:\Program Files\7-Zip\7zFM.exe - bc06c4d50923a9acfea294a96559f0e604448ed015147a9113affa8c2262b84a
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe - 9e12d19a081985adb91c588153f01c6f91d5b0a84fb3842bfdf7891ae0e091a7
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - fd7be616a91b09cd87744db44d4d233e6ff80cb488b641702ca7bf6a39b1ae95
C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - 9207aa0cabb248baa96a7e1f3ecfa854e5ccbd137c1098d2789de5a0a0dc699f
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Google\Chrome\Application\chrome.exe - ba9baca437f144d8c6b5da6c8e87d26bf39b9e582db3c4ef2d3ca263f1be202b
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - 1202978f9d84a0ccb5cc545e5a79b1f01b55e912abcb114c42328e15054be153
C:\Users\analyst\AppData\Local\Temp\tsk_f1202e401d754548.mm - 9f69a0d448101a4906b509e35133291082f748928ead1a8c1f2f140036d2b1a5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 9a96264b937cb6e5be5881659dd117949122cde44657a1c16cd552f992d2c5e4
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - f7f577e9e8fd4f639bc6441ad0c5436d3f0fd3c8fe0fc7eca16d3826253011cb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 7fcd023571e64c7bd134b5bb7a311dad2391b4a6a1ed3a55a82d9f41425768f5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - b5d4356164924d7d53fd078f0612cb4e0bfe75b508148bace80c40babd93dd83
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac

Embedded URLs

http://go.microsoft.com/fwlink/?LinkId=154498
http://www.w3.org/2001/XMLSchema-instance
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.certum.pl/ctnca.crl0k
http://repository.certum.pl/ctnca.cer0@
http://www.certum.pl/CPS0
http://repository.certum.pl/ctnca.cer09
http://crl.certum.pl/cscasha2.crl0q
http://repository.certum.pl/cscasha2.cer0
https://www.certum.pl/CPS0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

go.microsoft.com
www.w3.org
schemas.microsoft.com
crl.certum.pl
repository.certum.pl
www.certum.pl
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

7.1.3.2
52.182.141.63
4.230.171.124
4.247.188.224
52.230.60.54
135.233.95.144
57.155.101.212
135.233.95.135
20.50.80.215
92.223.78.30
52.148.114.188
72.154.7.109
52.110.12.20
52.110.12.48

File paths

C:\TFS_SDK\Windows
C:\cygwin64\home\buildslave\r\workdir\LinkTarget\Executable\swriter.pdb

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report