MALICIOUS — b6c9c76c556c85402ad4cf287eeea2980ac76de50632844fff8f63b745a670a6

MALICIOUS — b6c9c76c556c85402ad4cf287eeea2980ac76de50632844fff8f63b745a670a6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Lmir family. 5 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b6c9c76c556c85402ad4cf287eeea2980ac76de50632844fff8f63b745a670a6
SHA-1: 068b8f9fd74ae672570a95c3e320625d268db3cf
MD5: ca4c709f5516752c455da074be392132
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 6144:BKiDrDb8UwqGv42hlwlW/4ymfuOvOYOhODOXOYOzODOaOpOxO1O3OvOJO8O+O/O/:surX3cv42hlwU/4YLD
TLSH: T1ED465BA94ACD5682D62287EF3E344B4F0091FC5C846D4DC62B2B942D9BF6F7722C4249
Submitted as: b6c9c76c556c85402ad4cf287eeea2980ac76de50632844fff8f63b745a670a6
File type: pe · Size: 301176 bytes
Verdict: malicious (97/100) · Family: Lmir

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Lmir-22
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: PWS:Win32/Lmir
Emsisoft (Emergency Kit): Gen:Variant.Zusy.473172

MITRE ATT&CK

T1057

Why this verdict

The malicious score of 97/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Contacted 18 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

0 behavior events · 0 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787929859&P2=404&P3=2&P4=k%2fNsRaIlxnp7vqP%2fPzjJ9Y9tmmFGXNJ%2bgyEFXaC3qz%2fb7QsOVvUH6U7ajYpRvNzNIZXB7RHepL2v9n9s6qmWnA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com

Embedded IP addresses

4.150.223.101
4.144.132.114
4.247.188.224
4.230.171.124
20.165.94.63
74.178.76.54
4.150.223.106
52.123.128.14
20.76.201.171
52.123.129.14
203.26.79.13
74.179.71.159
52.148.114.188
72.153.5.137
162.159.142.9
52.110.12.45
135.234.160.246
52.110.12.18

File paths

F:\Office\Target\x86\ship\postc2r\x-none\onenotem.pdb

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report