MALICIOUS — c19c3b38b36bf27abda111fbd1885eb2436ca3fd748df121c6bd48c8e336175b

MALICIOUS — c19c3b38b36bf27abda111fbd1885eb2436ca3fd748df121c6bd48c8e336175b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 8 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: c19c3b38b36bf27abda111fbd1885eb2436ca3fd748df121c6bd48c8e336175b
SHA-1: f0ccbbaa0ea9a26c8787535b975fd06f5de07513
MD5: 22ef583bf2d0a317b3b0fdbdff59aca7
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:AajdMJb6SqIqOq2eJCdlCgyVQr1xonNdO+bfPcvKbcp/h8CAO:92JbM2yYl9yqyNb3ZO
TLSH: T1594927667B2F9327C175CA6C5A84092DC621BEA5143B97DC9EC3C82E93FC837E051129
Submitted as: c19c3b38b36bf27abda111fbd1885eb2436ca3fd748df121c6bd48c8e336175b
File type: pe · Size: 414062 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (8 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking!atmnm
Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
Trellix Stinger (McAfee): PWS-FCMH!22EF583BF2D0
Kaspersky (KVRT): Trojan.Win32.Patched.rv

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking!atmnm (rule Virus:Win32/Viking!atmnm) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Delf.Lmir.CE051F6F (rule GenPack:Generic.Delf.Lmir.CE051F6F) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWS-FCMH!22EF583BF2D0 (rule PWS-FCMH!22EF583BF2D0) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Patched.rv (rule Trojan.Win32.Patched.rv) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

39836 behavior events · 2 ATT&CK techniques · 58 dropped files.

Dropped files

C:\Program Files\Google\Chrome\Application\151.0.7922.174\os_update_handler.exe - 324376dffa38b86ac8e63c8f19d7298d6f7c1d74b92f02adcbfc067c1b07d4f7
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - db9c84e627a0f2ec799134e77c72fb40cffd18b7121d03a1704e537ff773da15
C:\Program Files\7-Zip\Uninstall.exe - 5f2d8f1c61585a4ec53c33838fa26d3d15d72fbc0c1b4c22fa5013df22c063b1
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - f76b5a93e3b69c733a8d9f319470a59d1aa6da05ca2f1d162d159474a70ea3d0
C:\Program Files\7-Zip\7zG.exe - a88265e523ccd1b6100e454640c8dc024f9bc50b124d4881f6ef17f79ec11dcb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - 9ff422bd4ec5c3c074bff7a26f9af3b105b67f84e1eb9031d839ce25f8f25a68
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - f9e29f82d30b013fb7972a28e57b13d699b503154d3b70a742bcf13fb6ce2db2
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 669aa35b6ad491d112c6b6fa2ee4dfc947cc75581b3766ae6884905018c2e86a
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - b2e0cc9aa0502da71140f087a8c970a8ec235e37b43b1ebc8d9f8ea08c890bb3
C:\Program Files\Google\Chrome\Application\chrome_proxy.exe - f6e53f51163fe47e43577e129fd7ee165c91f16f6968d47f9ff542779fb539ca
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 8857dbe759aed5c25e2cf192c00e967ab2b6601e99912650853093298689af00
C:\Program Files\7-Zip\7z.exe - 0be8d4b54577f5f71411bc4ca962ecc53ed19c8a7cffb5c06146aa7c1fc824c8

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
aefd.nelreports.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.171
52.123.252.194
4.230.171.124
40.84.97.4
52.230.59.222
135.233.95.144
74.178.240.51
20.42.65.89
74.178.240.61
4.207.44.69
172.66.2.5
85.210.193.152
52.110.12.28
52.110.12.54
40.79.167.9
72.153.5.132
52.148.114.188
52.110.12.11
52.110.12.16

File paths

X:\:`:d:r:
J:\:
L:\:l:
X:\:`:d:h:l:p:t:x:
g:\Acro_root_atg\Acrobat\Viewer\Win\output\acrobat\AcroRd32Exe.pdb
E:\+kAA

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report