MALICIOUS — b55cc6b14ad12dc930171e521aa9e37f7e873c66528e09dd93f1d12045895a4a

MALICIOUS — b55cc6b14ad12dc930171e521aa9e37f7e873c66528e09dd93f1d12045895a4a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: b55cc6b14ad12dc930171e521aa9e37f7e873c66528e09dd93f1d12045895a4a
SHA-1: 6e44c2a8f48fc692e33fab2415b9ddc36d7e21a4
MD5: 67a686cca33c62e9b703788dc3ade743
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:MajdMJyFRe6azHqTG5WbWRF+WR4VyKh6XnVyyx5kKbe3x0vUF7Ap/7R8:x2JylsKT3W4VyPqK67C8
TLSH: T1AA499EBF075F1743D6BBDA280904ABEE0021F465107CA58C1A73D13DA3EB86BBE51259
Submitted as: b55cc6b14ad12dc930171e521aa9e37f7e873c66528e09dd93f1d12045895a4a
File type: pe · Size: 390844 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:ÒuÛëÔ
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Generic.Delf.Lmir.A28B2EEC
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: updater.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:ÒuÛëÔ - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

31916 behavior events · 2 ATT&CK techniques · 51 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\soffice.exe - cef4888adafc6ebcb3c9488e397525ee4c1172f865c8b85842bee64420421970
C:\Program Files\LibreOffice\program\unopkg.exe - 12a0141d4c6146da2a90c737a770ae67d9ec9c4f8d8393ee0f4b4ce870bce6bf
C:\Program Files\LibreOffice\program\swriter.exe - 86b5f0008b031b8608598164973a4bd02d6e50e9ebe2bae8c005b46c9e908fba
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\senddoc.exe - f0655e9e80ffd82aab290a30cd07096f06895baf4d128feb78953a0860f74938
C:\Program Files\LibreOffice\program\quickstart.exe - 447e7b85a212d27dd65b5397f56df592346973316871705b2e81557f7aa70e26
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - 767ba5a27c96f6d624d6f7c50602bec0262abe669aa5ac02620207204c4ecaf1
C:\Program Files\LibreOffice\program\uno.exe - 420951c165c750de2a231f93b41da94ac38ebde88bf74b4f2afdb70ebd4a615d
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - 1a8cbb0e3f0ecffe46225b81e14ba39db67147171b88de187e7cdfd356d66db7
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - 95d2464e804b510ee1ea9de178bf54cbde9de9154e2ef8458822c8a5ee953f5e
C:\Program Files\LibreOffice\program\unoinfo.exe - 43995b3787ed50655c873d9be08a59a5972ca20f5704ff5aef792b4412634b27
C:\Program Files\LibreOffice\program\sdraw.exe - ca642a93aa4a84c803dac46ff85bfbfe104cdcf98f36b647d85ee992ef7baa73
C:\Windows\GOG.exe - 1527933d5fbeff16bedcdcac19ad99df3ea7f3cfeec577ee0faad9a4cc8f36ca
C:\Program Files\LibreOffice\program\opencltest.exe - d02cc376953ee8072222230a69dc8c7515a4812d8fb70a4de05b40e88ebb8f9d
C:\Users\analyst\AppData\Local\Temp\tsk_7efa77a339ea4573.tmp - 405d382330ae2af798141eefa9fdea5e707d50db244459672e56f13b17bdcbe0

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.microsoft.com/DRM/SL/WGA/Parameters/1.0
http://www.microsoft.com/DRM/XrML2/SL/v2
http://www.microsoft.com/DRM/XrML2/TM/v2
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787909167&P2=404&P3=2&P4=Na04RP6bSSiZ6Edu82AHR8Mvy%2boUNz4rpnSQMpfJAxeEGeSwNmiJdex2lF%2b5RVofl6A%2b9cG7aXb6Zu7CYOztxQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787909241&P2=404&P3=2&P4=maxjrgRi2IMGjC2cf4Bgc9frQjUMopfVACq0VRPQK%2bzIRk0Of43YcWnCl58zicvsa%2fn%2fyZJ687W22qaa6uIQeQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

52.182.141.63
52.123.252.242
48.211.4.16
4.144.132.223
4.230.171.124
74.178.76.128
20.165.94.54
4.150.223.109
20.236.44.162
52.123.129.14
40.103.64.226
52.123.128.14
92.223.78.30
172.215.188.225
172.178.240.162
203.26.79.13
52.148.114.188
52.123.252.240
20.165.94.46
20.184.175.13
104.208.16.94
72.154.7.101
52.110.12.44
52.110.12.19

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report