MALICIOUS — dad0ad178192b704fd4f77c0fb9c2fd225ebaf13aaf6addeaa4ebcd619f1c3ef
MALICIOUS — dad0ad178192b704fd4f77c0fb9c2fd225ebaf13aaf6addeaa4ebcd619f1c3ef is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
dad0ad178192b704fd4f77c0fb9c2fd225ebaf13aaf6addeaa4ebcd619f1c3ef - SHA-1:
74e8d47b059186d53fd4c88e85929da849ef2db0 - MD5:
d277b9d8d300eb7437275688c19c0628 - imphash:
aae410db5a351d384de2e35faf59497e - ssdeep:
6144:AajdMJb6SqIqOq2eJCdlCgyVQr1wonNQC0tmcMATA4thRJMcmmi0:92JbM2yYl9yqBNEA4thRN1 - TLSH:
T151478C7E066F3A13D2B7D6181C006FAE4022F47E107EA58C6297C57DE3FAC275A61258 - Submitted as: dad0ad178192b704fd4f77c0fb9c2fd225ebaf13aaf6addeaa4ebcd619f1c3ef
- File type: pe · Size: 333186 bytes
- Verdict: malicious (100/100) · Family: Lmir
Detections (7 of 56 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Trojan.Lmir-22
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Viking!atmnm
- Emsisoft (Emergency Kit): GenPack:Generic.Delf.Lmir.CE051F6F
- Trellix Stinger (McAfee): PWS-FCMH!D277B9D8D300
- Kaspersky (KVRT): Trojan.Win32.Patched.rv
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 17 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule
Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_638129d758 (pid 7784) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Virus:Win32/Viking!atmnm (rule
Virus:Win32/Viking!atmnm) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged GenPack:Generic.Delf.Lmir.CE051F6F (rule
GenPack:Generic.Delf.Lmir.CE051F6F) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged PWS-FCMH!D277B9D8D300 (rule
PWS-FCMH!D277B9D8D300) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Patched.rv (rule
Trojan.Win32.Patched.rv) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- capa (capabilities) flagged capability:collection/keylog (rule
capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
40113 behavior events · 2 ATT&CK techniques · 59 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- edge.microsoft.com
- v10.events.data.microsoft.com
- settings-win.data.microsoft.com
- time.windows.com
Dropped files
- C:\Program Files\7-Zip\7z.exe -
cddac674d7b58bdc8de1a0939054eb85d81fa4eee18fa8bef569832e37a9f47b - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe -
b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68 - C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe -
e0b630dfc1ea0505665679aa0aef788aaab6badadc36d152f804b06f4af63cd0 - C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe -
377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 -
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - C:\Program Files\Adobe\Acrobat DC\Acrobat\ShowAppPickerForPDF.exe -
f690dbea96c4002484f79cb44963f0c1822565bf08dd894b7d7d9bd2774812c8 - C:\Program Files\LibreOffice\program\gengal.exe -
24753f9cd62710031bb1adb382d866b2672fdc3922e51f16e7806f50206ca3bc - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe -
b038a358fd2c1c514f8800c3a59da756d49e21139cd3c2b93b8879422a86298b - C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe -
698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe -
f1fe55eea7b0d37b8deee75f0c583f7702100ca26dd432001cf9c500a13b42de - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe -
03519e01f8877a1b6eb42ad076e6b7ac756f5f991d6136df25608ece3bdfeb47 - C:\Program Files\Google\Chrome\Application\151.0.7922.174\Installer\setup.exe -
692ea3fb4f9b703d17a7919ffecb22e07f7ef67689d4d6bfc7a2d4a523a92cd4 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe -
a5be2ca64e654115c4b4e9565e01d5394c02a674fa8e12e0b16fd7ceb1d28fe4 - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe -
7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b - C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevated_tracing_service.exe -
039f8ab7563c15c15b6e07e6ddcf6787a6bf04daf17507b90ab6bed22518bb6b
Embedded URLs
- http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
- http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
- http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- crl.microsoft.com
- www.microsoft.com
Embedded IP addresses
- 4.150.223.113
- 20.247.184.197
- 4.230.171.124
- 4.247.188.233
- 4.150.223.103
- 184.84.165.136
- 57.155.104.224
- 52.110.12.48
- 52.110.12.22
- 52.148.114.188
- 72.145.35.111
File paths
- X:\:`:d:r:
- J:\:
- L:\:l:
- X:\:`:d:h:l:p:t:x:
- d:\office\source\util\threadpool\src\init.cpp
- d:\office\source\util\threadpool\inc\threadpool.h
- d:\office\source\util\threadpool\src\threadpool.cpp
- d:\office\source\util\threadpool\src\primitives.cpp
- d:\office\source\util\threadpool\inc\sharedlock.h
- d:\office\source\util\threadpool\src\sharedlock.cpp
- d:\office\source\util\threadpool\src\misc.cpp
- d:\office\source\util\threadpool\src\waiterthread.cpp
- d:\office\source\util\threadpool\src\work.cpp
- d:\office\source\util\threadpool\src\threadres.cpp
- d:\office\source\util\threadpool\src\timerobj.cpp
- d:\office\source\util\threadpool\src\idle.cpp
- d:\office\source\util\threadpool\src\workerqueue.cpp
- d:\office\source\util\threadpool\src\power.cpp
More Lmir samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report