MALICIOUS — 7b8dca577968245b1fd10c2da1d1d421208c20609788fcabe5221caed6fa12a2
MALICIOUS — 7b8dca577968245b1fd10c2da1d1d421208c20609788fcabe5221caed6fa12a2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 8 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
7b8dca577968245b1fd10c2da1d1d421208c20609788fcabe5221caed6fa12a2 - SHA-1:
98ef3172bd90be233b8d190a3482a951ec6b6ce5 - MD5:
d53a144c629ec0cc3e035a96c7e5a270 - imphash:
aae410db5a351d384de2e35faf59497e - ssdeep:
6144:AajdMJb6SqIqOq2eJCdlCgyVQr1XonNdO+bnt5Z:92JbM2yYl9yqYNbn7Z - TLSH:
T1A6457C3A176F3A07D6B6C61868006F7E4122F8BA107D58CC26A3C53DE3FEC672651259 - Submitted as: 7b8dca577968245b1fd10c2da1d1d421208c20609788fcabe5221caed6fa12a2
- File type: pe · Size: 282812 bytes
- Verdict: malicious (100/100) · Family: Lmir
Detections (8 of 56 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Lmir-22
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Virus:Win32/Viking!atmnm
- Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
- Trellix Stinger (McAfee): PWS-FCMH!D53A144C629E
- Kaspersky (KVRT): Trojan.Win32.Patched.rv
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 17 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule
Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Microsoft Defender flagged Virus:Win32/Viking!atmnm (rule
Virus:Win32/Viking!atmnm) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged GenPack:Generic.Delf.Lmir.CE051F6F (rule
GenPack:Generic.Delf.Lmir.CE051F6F) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-FCMH!D53A144C629E (rule
PWS-FCMH!D53A144C629E) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Patched.rv (rule
Trojan.Win32.Patched.rv) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 2 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
39891 behavior events · 2 ATT&CK techniques · 58 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- licensing.mp.microsoft.com
- www.bing.com
- assets.msn.com
- fe3cr.delivery.mp.microsoft.com
- settings-win.data.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevation_service.exe -
15c96782d872698babbd5e9c61a67f9e20919aa97096de6b420efeeec05ef8d9 - C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe -
194ace9b707eac29f4e83bbe11a7eed24e4ea0c3eaef2546968bf5e36e408d58 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe -
24161e1615b0d9f4b7785ccc9e64b869c90659d8b6a4a7185a6a554bd1a8b9a1 - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe -
b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68 - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe -
998d1bc1ff12ed965188dc5ad377ccaf7487c609b9c23ff0924dda1472983ba3 - C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe -
a2c4206e4bd4850db0bc74cf2d37987f977681ddb4a8af75cd1db7c79dbb8662 - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe -
377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe -
092e5b87a66fc68c65331a8690a4dc7bbd96b1f5557e06d2f2a146bc11025599 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe -
469045c7f9874728455b949991b91d40a8696464ff20927ab79f3eb411ceab47 - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe -
4dafc06c46fb0447a9e5c99a161d3100bbbd87f116c3ffbdd21242d7e42aa027 - C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe -
263aaccdc6d6da8ac578e7760a7dd1bde93d95c3089526a3ce0d9ac9d5c14783 - C:\Program Files\7-Zip\7z.exe -
52e16c185bcb7693fd9c235b2ec1d9a99c870fddd9491d32c3535b625538e430 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe -
ee002554216ea26d8d6cec7db6010749aa08d691880ab7f9b4ffaf129468bcf1 - C:\Program Files\Google\Chrome\Application\chrome_proxy.exe -
830b4f5ba6eaab2935646941425c7805df30204f003d730ed1fe800d1fe67ce0
Embedded URLs
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
- http://crl3.digicert.com/sha2-assured-ts.crl02
- http://crl4.digicert.com/sha2-assured-ts.crl0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
Embedded IP addresses
- 4.150.223.107
- 52.230.59.222
- 4.230.171.124
- 135.232.92.97
- 172.215.188.232
- 40.74.98.197
- 135.233.95.144
- 92.223.78.30
- 52.110.12.19
- 52.110.12.1
- 20.184.175.17
- 40.84.85.40
- 72.154.7.103
- 52.148.114.188
- 4.150.223.112
- 52.110.12.22
- 52.110.12.24
File paths
- X:\:`:d:r:
- J:\:
- L:\:l:
- X:\:`:d:h:l:p:t:x:
- g:\Acro_root_atg\Acrobat\Viewer\Win\output\acrobat\AcroRd32Exe.pdb
- c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u281\880\build\windows-amd64\jdk\objs\orbd_objs\orbd.pdb
More Lmir samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report