MALICIOUS — fd56c0127be6ae1d7e4f2c44e00be16ead6a001171de117d3452e008891b93be

MALICIOUS — fd56c0127be6ae1d7e4f2c44e00be16ead6a001171de117d3452e008891b93be is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lmir family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: fd56c0127be6ae1d7e4f2c44e00be16ead6a001171de117d3452e008891b93be
SHA-1: fb557737a1ee787ba86e792892ff753139d53f5a
MD5: 2dfd7236da0698afa8ba883701dc177c
imphash: aae410db5a351d384de2e35faf59497e
ssdeep: 3072:rAs9EjdgAnEFJjJgbhDzjJkSnGH6aqjjdos+HozLr83qHq/cB9FtQTkJsHahoSXC:rajdMJyFRe6azHqTGXHaeaEcs9qM
TLSH: T12B447C7E275F2B57EB77C71809405F5E0062F87A107E188C26E3C22DA3EEC9B5A51218
Submitted as: fd56c0127be6ae1d7e4f2c44e00be16ead6a001171de117d3452e008891b93be
File type: pe · Size: 261512 bytes
Verdict: malicious (100/100) · Family: Lmir

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Lmir-22
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MR
Emsisoft (Emergency Kit): Dropped:Generic.Delf.Lmir.2EC949F5
Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Lmir-22 (rule Win.Trojan.Lmir-22) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MR (rule Virus:Win32/Viking.MR) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Delf.Lmir.2EC949F5 (rule Dropped:Generic.Delf.Lmir.2EC949F5) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.gen (rule Trojan-GameThief.Win32.Lmir.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 56 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

64433 behavior events · 3 ATT&CK techniques · 62 dropped files.

Dropped files

C:\Program Files\7-Zip\7zG.exe - 02d5daa25530c5a0c32c51b226c4a8eed9af5c3f2201fa3e43eb0ce48cae1dc6
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe - 5a2bcaeb288de65ade79969eae9fc960fb4af09c1c3ca59abdea3177ef0e22c5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 6c1f46f09c0df9ea7a07270ad2a1f64da2bc83adf77f62e612f108bf0e4a5683
C:\Users\analyst\AppData\Local\Temp\tsk_2ac42320c8f443d0.tmp - 497f26fa64618bc336716fbf39378bcb63631c389276dd678b28e1e1359f3814
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - 39a430a11ea2bd81dc25ddf8a551e8926990da39f0d14ec090c8a7c1cfd59cf1
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Program Files\LibreOffice\program\gengal.exe - bde89cfba350176a837aa97bd7e8c36332f8d04b58830b2e616abef78af1a2fd
C:\Program Files\7-Zip\7zFM.exe - 7d2a7e84f0dc44ae81528367af90b5f1ffedc7d28e7a4c44356ea2a9eaa198e1
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - c3104a3fead1a48129324b5915881bacf4aaf97784565eb75f91c506291db0bd
C:\Program Files\Google\Chrome\Application\151.0.7922.174\elevation_service.exe - 78f789c007ae9048e3697aadd57374c061548d01be9b54710e8de32ca77ad05c
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - fb6802a24c9afba14e99a5d700b60bedaff8c30b346cbdcedcec780e89d5e91b
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 7ab807b2f85d1de86a4ddbdc9efffe045c74d75668f9e7428999e863a062507b

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.verisign.com
crl.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.30
52.123.252.203
4.230.171.124
20.247.184.197
85.210.196.11
74.178.240.61
74.179.77.164
51.105.71.137
74.178.76.128
172.64.154.167
4.150.223.106
92.223.78.30
135.234.160.244
52.110.12.16
57.154.63.210
52.110.12.54
125.56.205.17
125.56.205.42
72.153.5.129
52.148.114.188
52.110.12.15
52.110.12.32

File paths

X:\:`:d:h:l:p:t:x:
f:\VSTArtm\Tools\devdiv\FinalPublicKey.snk

More Lmir samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report