MALICIOUS — f4d7806ce4deb7f39ef92261ab0f382dfde8609df222e966d5457ff53aba1a75

MALICIOUS — f4d7806ce4deb7f39ef92261ab0f382dfde8609df222e966d5457ff53aba1a75 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: f4d7806ce4deb7f39ef92261ab0f382dfde8609df222e966d5457ff53aba1a75
SHA-1: 771aa57c8a82ccff34338ed311d1d4fd7e82c84c
MD5: 73a015bfbbfbd8bf0c088333095dfd0d
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 6144:rajdMJyFRe6azHqTGXHaeaEOaUmLSeoQUzw3c:E2JylsKTUHOaEQUB
TLSH: T15E477C3A438F2353E1B6D92468105BAD4426F8BD20FE5CCC2323D43D97EACB7A561295
Submitted as: f4d7806ce4deb7f39ef92261ab0f382dfde8609df222e966d5457ff53aba1a75
File type: pe · Size: 342948 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MR
Emsisoft (Emergency Kit): Dropped:Generic.Delf.Lmir.2EC949F5
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MR (rule Virus:Win32/Viking.MR) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Delf.Lmir.2EC949F5 (rule Dropped:Generic.Delf.Lmir.2EC949F5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.gen (rule Trojan-GameThief.Win32.Lmir.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

38305 behavior events · 2 ATT&CK techniques · 58 dropped files.

Dropped files

C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 00515867f15cf8869f59e94f05ea53fb030a4ee48d34630e73deb21c33ae0dc5
C:\Program Files\7-Zip\7zFM.exe - 14c206a73c48a6e0af64a93054e3508a79121488dac2a9ec07e1d2736aa303e9
C:\Program Files\Adobe\Acrobat DC\Acrobat\Assets\MenuCoreApp\AcroShareTarget.exe - b07f2a971cfef9dfc9eba0539fe661c72c93f07e5706711c766b1d6b663ecb3c
C:\Program Files\Adobe\Acrobat DC\Acrobat\CPInstCU.exe - 00f4dd374311712b10af1d247aa24e020e602d5d56bcfd74f7d1515fd54ab145
C:\Program Files\Google\Chrome\Application\151.0.7922.174\notification_helper.exe - ba8ff2266a6f9e1d98d40c827413428a0384e071e3d41ab7fa404d66765b1ab7
C:\Windows\SOS.exe - d0cdd840cb25c8bcd9ca07c11675964c474de3658ba1bc88c90cfee6bf75b036
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - 7afe3b242dd6d51d700659c608ce92bce3a7593fd60ead146effb7dd31dd682b
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevation_service.exe - 98b58a6b43f05232b4bbb9a2baeacd5f4e36b1804ce3e81936f4bd8a6a8a1701
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 89c832c935bc88cc7ef29b2703579b20e4620c12c83298d6ebbd91e3809a80c6
C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe - 44303632dd98cc867d54eac9cc95583c5a479a3145d70f90770f662fcf1c0f1a
C:\Program Files\Adobe\Acrobat DC\Acrobat\OSSLLibs\AdobeFips.exe - 65a22ece392332e9dd1907e747c810d6a0559cfbe31adc89990ea6f9ea0960da

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.19
52.123.252.198
4.247.188.233
4.230.171.124
20.247.184.142
57.154.63.210
20.165.94.63
20.184.175.0
74.178.240.51
104.208.16.94
172.64.154.167
20.42.179.204
4.150.223.113
52.168.117.170
72.145.35.104
52.148.114.188
92.223.78.30
52.110.12.19
52.110.12.52

File paths

X:\:`:d:h:l:p:t:x:

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report