MALICIOUS — 84d36f029fc2c32285f1e92784140a64c57eb88fb012501c420967e1a231a25b

MALICIOUS — 84d36f029fc2c32285f1e92784140a64c57eb88fb012501c420967e1a231a25b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 8 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 84d36f029fc2c32285f1e92784140a64c57eb88fb012501c420967e1a231a25b
SHA-1: 2034988ddeb1357c2afe97270adba365c10d775e
MD5: 4f7dcb80576ccc5c0201722d9b264889
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:AajdMJb6SqIqOq2eJCdlCgyVQr1UonNta8Dwo9+K:92JbM2yYl9yqdNtato9+K
TLSH: T1C24B18690A2A7683C6F6CA181D109A3D001DF4A7117D758B5EE3A02FF3FB8771661247
Submitted as: 84d36f029fc2c32285f1e92784140a64c57eb88fb012501c420967e1a231a25b
File type: pe · Size: 470064 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (8 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking!atmnm
Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
Trellix Stinger (McAfee): PWS-FCMH!4F7DCB80576C
Kaspersky (KVRT): Trojan.Win32.Patched.rv

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: updater.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 6.0.1.0 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

33261 behavior events · 2 ATT&CK techniques · 51 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\simpress.exe - a0a1a606f0002125ffdaff7cf8f706c7764c3ccb8fb1acee749a8cc5114de89c
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64-arm.exe - 6f7f6a4696a0a53047303943d8880cc3e8e5853d69891a07eb1494fa01b3af44
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\pythonw.exe - 67fc4dafd7b034c2df156c29bcf4d285500c00acc2356c7f6a27e97a9b06ee22
C:\Windows\GOG.exe - 5b6d21988afea08fc0e272c4be9e4bf60ce20ce763dbec683d48b0a7be760c2e
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 3f0ae976b46160ccc88c70e57c0bdf301ae7a471c1ffef379696317eae82862f
C:\Program Files\LibreOffice\program\python.exe - df013e1c853165b293fe5d8fae5ecd78a7ffe1667e05208c39467f27766aacc0
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - 8f205b82c3617259bfdb86b8f213bb471081bb170960f01107a568adffa89940
C:\Program Files\LibreOffice\program\spsupp_helper.exe - f54c10e100b7fe2867891056c609d7c2ab6cdeddec459dd537922fdeee4f0750
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - d47d366c7ba35a458639f59a334469f4f5c9c6f3c16cd8020e8e7208e64bd4d8
C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe - e5b51481fa311c605cc312bbb9600907eebb15a3bca4c3741a13af0e6fdfa557
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 0f3f114d5b65b34689754e8da77363aa4615e5436ac3a5b3496e77750e191208
C:\Program Files\LibreOffice\program\xpdfimport.exe - dca5d0aabf0815d8c56da9d69402a74bcf949e600f0fe4e74d4a88bee429b446
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64.exe - 1ed744cf88f84fe9fb2749283ae8e2d3a018d2b159df43b173850e0fe6a41922
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w32.exe - 949fccc8b9827b589d98c1a14816fd19b43a0d8a844504503c43cb4047794759

Embedded URLs

http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787843797&P2=404&P3=2&P4=IQnwSyb1LuY9OrdLN28IDD2dHMtKf69x%2bjJhTqLYjIiyvh83Lk%2fC2nRXFd0QmQz0BcdXsKCSZs%2fm54HLW6jhWA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787843853&P2=404&P3=2&P4=SLSla3V0CXgiovveRCigRP3u4%2bqNKi6X%2fPcW710JLeQVlJhZxHjZhzLgdyEgP5Ii8WQGM5IpTawwZnWXwftHYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

6.0.1.0
20.42.73.25
52.123.252.232
52.230.59.222
57.154.63.210
4.230.171.124
20.165.94.63
135.232.92.97
4.150.223.102
40.99.134.2
20.231.239.246
52.123.129.14
40.99.133.242
52.123.128.14
172.178.240.161
52.123.252.215
52.110.12.21
52.110.12.44
203.26.79.13
52.148.114.188
74.178.76.44
92.223.78.30
52.110.12.25
72.145.35.97
52.110.12.56

File paths

X:\:`:d:r:
J:\:
L:\:l:
X:\:`:d:h:l:p:t:x:
P:\Target\x86\ship\setupexe\x-none\setup.pdb

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report