MALICIOUS — af569ee985a279ead6234b61ce1957557eb573ae067d06d2c1ab77eda4c4f72d

MALICIOUS — af569ee985a279ead6234b61ce1957557eb573ae067d06d2c1ab77eda4c4f72d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: af569ee985a279ead6234b61ce1957557eb573ae067d06d2c1ab77eda4c4f72d
SHA-1: d9f1c75aa0a4b65ff53535bb4220c9bdeff3fce5
MD5: 32c49e10edd3251d35e24c9f5d8df804
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:rajdMJyFRe6azHqTGXHaeaEPH2dMQRvg630Qmrp/CkhXk1GfK+5n16svC7P:E2JylsKTUHPfQRvn0ZvbPIP
TLSH: T1964A9D7A426B6617E1FBC62428008F9D8423F4AE10BE64CD6387C62DE3FAC7795B0155
Submitted as: af569ee985a279ead6234b61ce1957557eb573ae067d06d2c1ab77eda4c4f72d
File type: pe · Size: 463382 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MR
Emsisoft (Emergency Kit): Dropped:Generic.Delf.Lmir.2EC949F5
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MR (rule Virus:Win32/Viking.MR) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Delf.Lmir.2EC949F5 (rule Dropped:Generic.Delf.Lmir.2EC949F5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.gen (rule Trojan-GameThief.Win32.Lmir.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

38320 behavior events · 2 ATT&CK techniques · 58 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - de72db99d9f083b07fe90abfb46bf1b0f593b73a06a3f7be694efad6bf91fece
C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe - a45bd00564585f61f072e404baa98d579bfd250c80d85aa18715de568d4a4879
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - d7688330b3b515a299e4c8ef4a212d305fb9f9dca52ec16ad9439c5ba4949a63
C:\Program Files\Google\Chrome\Application\151.0.7922.174\Installer\setup.exe - f2ec7eac253ba4f6870727abb5a34f45c3d22feddf8fea2530dc22da92587b0e
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - 609a71b70f2e12eb6df1076fd27ffc206ab52b5f010aaf1b5cd2b0c82840d94e
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - d04a102c818a6b0fdccfd690669459020b31396dbc80a08e9ae565958e12806d
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Program Files\Google\Chrome\Application\chrome.exe - ab8224450cad028f8f4588b47df6e0f873739e1b7e475f7b57cb6375583ba348
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - f5430d4d3d60a708a69ccce30739ac0c537eded5b66d1444c0498b435424844f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - b21e394896400f6e0c7912764290a9571044d467b08a1976e52591013e1b0f4a
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\64BitMAPIBroker.exe - 6a78dba30ca10f3addef5b1683bd7bc97e98ce03c9e6ae7056845ee1b70b7d10

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.99
20.42.179.204
4.230.171.124
20.247.185.124
74.178.240.51
4.150.223.103
74.178.76.128
172.64.154.167
52.110.12.30
20.42.73.30
20.42.65.90
125.56.205.65
125.56.205.123
72.154.7.104
52.148.114.188
92.223.78.30
52.110.12.1
52.110.12.8

File paths

X:\:`:d:h:l:p:t:x:

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report