MALICIOUS — d37818e73c86759a9263ef81e9e06f19b4d652371b2c06bea615f03955ebd1b8

MALICIOUS — d37818e73c86759a9263ef81e9e06f19b4d652371b2c06bea615f03955ebd1b8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: d37818e73c86759a9263ef81e9e06f19b4d652371b2c06bea615f03955ebd1b8
SHA-1: dbc7d391a29969ff3a5a90a1552d443cd801ea01
MD5: e187844323b0ee7db162403b547a0ef9
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:MajdMJyFRe6azHqTG5WbWSF+WR4VyKh6So3EgouSFlPe1T5Pj+G3vcCL:x2JylsKTSW4VyPh3EZGfj
TLSH: T150499E7A1B5F2747E6BBC61818005BEE4022B87A10BD59CC5363D23DE3DBC67162129E
Submitted as: d37818e73c86759a9263ef81e9e06f19b4d652371b2c06bea615f03955ebd1b8
File type: pe · Size: 410030 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:ÒuÛëÔ
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Generic.Delf.Lmir.A28B2EEC
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload: updater.exe - dynamic signal, weight 0.62, confidence 0.90
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 23 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:ÒuÛëÔ - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

31987 behavior events · 2 ATT&CK techniques · 51 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\xpdfimport.exe - 0e48a0c433715c990727cc1699cc800cd70f61b29535494735a3fdf5319d302e
C:\Program Files\LibreOffice\program\sweb.exe - 7a43db394565c40656ee197c52a2ea896acf8720d9e06a85bec6688ccfb3f003
C:\Program Files\LibreOffice\program\sdraw.exe - 503faf17ee393382f4bc7bea7f01a05cf0d8d864b430da93f2529f809c86331c
C:\Program Files\LibreOffice\program\opencltest.exe - b3eb5a4e467cfa59b73ea98ac9654dd46051f7741a89df93365b205fcd18d96c
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - a783dcf192621f1ffdd8aff1bcbbcd6c4922f4b19f7830125b966aa439e779cd
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w32.exe - 8cc3010b6fc1e84a485fd1768698ed326ca81aa486f3203bd7b30a48dfdd51c2
C:\Program Files\LibreOffice\program\quickstart.exe - ef6921afdcf5ca8d86698f2481dbbde72f915660a547d930cd6ea8d1d4ab4e60
C:\Program Files\LibreOffice\program\update_service.exe - 93717d3e777c02b2590e36666616599e6a7ba4d122f88945f740f8985054f9b6
C:\Program Files\LibreOffice\program\gengal.exe - 4d4bb919a1bd879a53dcb1cf0338c228fc91af02bae25b800431caf58c0b5065
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - a781aface8c595db62a1838114262cf533d28dc77742e7d54723128ebe3873ac
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - b31a273264f849194d5609ea91d3653ef454d2cddc9f48570f9c3e89fba5866c
C:\Program Files\LibreOffice\program\soffice_safe.exe - 7a25dbbec539321aeddcd3ce238eb1da0f8a8c9440c77a7d4de0cbb915834a61
C:\Program Files\LibreOffice\program\python-core-3.12.13\bin\python.exe - da7f33ca9e55372426415e77861c76164aff78b53101e3646618770605283623
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8360d2cbfe6658f7c75c92c0ab92ad9de6d670cf360cf514d61edf9164902b8e

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787804189&P2=404&P3=2&P4=MjtJ%2bnkc49mZz0scf48Zdv1hJhEoxl0YspsdWQxUkaywYUoekpffhX1Mxuv3ajxRyVRWdpxTThvaSm%2bQXx986g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787804282&P2=404&P3=2&P4=BixdOhCBWP3kwfaZOT8uS4Lq3%2b4eJzaElXpX%2bO4TXwT9rL5tg%2fzhj%2fW98x3uSO5hd71By16QAnvXdFUyoSUM0A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com

Embedded IP addresses

20.42.73.30
52.123.252.223
20.247.184.197
57.154.63.210
4.230.171.124
74.179.77.204
135.232.92.97
20.42.73.31
20.76.201.171
52.123.128.14
40.99.134.18
20.42.65.88
172.178.240.162
52.123.252.241
203.26.79.13
52.148.114.188
52.110.12.25
48.211.4.16
4.150.223.101
74.178.76.44
72.153.5.131
52.110.12.38
52.110.12.8

Registry keys

HKCU\Software
HKCU\Software\Policies
HKLM\Software
HKLM\Software\Policies

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report