MALICIOUS — ad4b9c5c218d66061cb3ab50e5240a90265c21be85a3e74267d3f18f0087771f
MALICIOUS — ad4b9c5c218d66061cb3ab50e5240a90265c21be85a3e74267d3f18f0087771f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.
Identification
- SHA-256:
ad4b9c5c218d66061cb3ab50e5240a90265c21be85a3e74267d3f18f0087771f - SHA-1:
eb3eac5c7474de795c20630e8538b31ff05409f1 - MD5:
71ce8ba69edb7795024c040a1a7720e7 - imphash:
aae410db5a351d384de2e35faf59497e - ssdeep:
6144:AajdMJb6SqIqOq2eJCdlCgyVQr1X12dM1V:92JbM2yYl9yqdH - TLSH:
T1D3457D7A176F3743C2BBC6281800AF5E4522F87A11BD65CC12A7C63DE3FAC6B5661118 - Submitted as: ad4b9c5c218d66061cb3ab50e5240a90265c21be85a3e74267d3f18f0087771f
- File type: pe · Size: 278882 bytes
- Verdict: malicious (100/100) · Family: Lmir
Detections (7 of 55 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Lmir-22
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Viking!atmnm
- Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
- Trellix Stinger (McAfee): PWS-FCMH!71CE8BA69EDB
- Kaspersky (KVRT): Trojan.Win32.Patched.rv
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 11 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule
Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95 - Dropped a malicious payload: updater.exe - dynamic signal, weight 0.62, confidence 0.90
- 1 behavioral detection(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
33132 behavior events · 2 ATT&CK techniques · 52 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe -
5ce35f3977aa383e5c4ee12f24ba80a7ebadb0a496e6145a32d5c9e6beec5e26 - C:\Program Files\LibreOffice\program\gengal.exe -
ae585d4a2701a002e8554377c4da24ce1227b210f3d5a147a036d9d4f9da6768 - C:\Program Files\LibreOffice\program\sbase.exe -
b13b63e18fde68d32e147852e2d0b9bd6af63086b5fbd9343e1bbc2234d0cab0 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\LibreOffice\program\swriter.exe -
f9daaa2e943b8f74080807ba3812c7d235db7ed47866ab3f3cb841ba43073a7f - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe -
40c9580651a7c55ee219b430d99539f3d2a0b3dd24d7a213745ce4390599b7c3 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe -
06228001240f2bcfb531c6f209d380ac5dab79755f66b85afa420f0646ad85e0 - C:\Program Files\LibreOffice\program\sdraw.exe -
e6c9edc15912c055b445a239f3e9bbf20a4b5adc26f2752ec6fbfe1fd2f24ca8 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe -
674b2f504f65603f63b71d026cec3c261264af3b8f8f56953e0c1df06170a9b3 - C:\Program Files\LibreOffice\program\soffice_safe.exe -
546efd2888e702089eed649ed206307d4544989e19809d72bbf49ed6c8a1a8f3 - C:\Program Files\LibreOffice\program\unoinfo.exe -
826c65bff8509045a0655c4a97f9629ec005be1aa99f7a6dce43ed0daac23a6f - C:\Program Files\LibreOffice\program\update_service.exe -
9f70c9615618b64bbecd0eca2e0b7031280e508568e6476c34f5bd6099c14d8e - C:\Program Files\LibreOffice\program\minidump_upload.exe -
7f09937fb49dce267f8735c8f73390d1885e6731b139d535e99f742e62b7f7fc - C:\Program Files\LibreOffice\program\odbcconfig.exe -
b97afaa639885d5feea61b01b461d9276b97a1bd23a64e80b7c82303c810b479 - C:\Program Files\LibreOffice\program\uno.exe -
56a2baa3d028743ca5e0bb8784b120c087be106746ff015cd0b6f7fea224679a
Embedded URLs
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787895387&P2=404&P3=2&P4=XHQAU0PbaV7BTznsYFqaBkPzWMbVgRDdrUIY%2f1mpYje1oSvKV1UaAPoz2oXxHBA9tViR1szQuGgAYKKfggtBiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787895483&P2=404&P3=2&P4=TofiwcDLETsgqeqYdl17dBXam2qMCC2iG3psT%2fVVGlgzxzY2DMHDwNdJQ2XnN3RjFh3CnfL7ktjS2FY4t%2fKk3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- crl.microsoft.com
- www.microsoft.com
Embedded IP addresses
- 20.50.201.200
- 172.215.188.232
- 4.230.171.124
- 20.247.184.197
- 4.247.188.224
- 74.179.77.204
- 20.42.65.84
- 20.112.250.133
- 52.123.129.14
- 40.104.4.2
- 52.123.128.14
- 74.178.76.54
- 20.184.175.19
- 172.178.240.162
- 52.168.117.175
- 203.26.79.13
- 52.148.114.188
- 52.123.252.238
- 135.232.92.34
- 52.110.12.45
- 72.154.7.103
- 52.110.12.19
File paths
- X:\:`:d:r:
- J:\:
- L:\:l:
- X:\:`:d:h:l:p:t:x:
More Lmir samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report