MALICIOUS — ddc37b7ee958ed291e9bbe63ce53cf275d3e8b783db017cbcc30d3e92f3122f0

MALICIOUS — ddc37b7ee958ed291e9bbe63ce53cf275d3e8b783db017cbcc30d3e92f3122f0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lamer family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: ddc37b7ee958ed291e9bbe63ce53cf275d3e8b783db017cbcc30d3e92f3122f0
SHA-1: ef468c74ec4d88d1ff9b64ffaaece3c9c7c18e31
MD5: c37988f0fe39c47c9345e45ab0ed8dd3
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmitocVEO0R/:qKtfDwsjPThTYszDH2frE
TLSH: T1BE3A27AD0B5D2B41E7B5CA312821A6DE01A1F1E9107A704D4E27923F57E3823FD718AD
Submitted as: ddc37b7ee958ed291e9bbe63ce53cf275d3e8b783db017cbcc30d3e92f3122f0
File type: pe · Size: 94208 bytes
Verdict: malicious (100/100) · Family: Lamer

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

59978 behavior events · 2 ATT&CK techniques · 99 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe - e5fc5c518cd6e6870c4c588ee2b6035f4d51d3d40c1f3af8fbaae16be3be6f2f
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64.exe - 900d1aafc556d7d63aa97d0762fbdd596dd5198c664070e07d14f15f90f60ff7
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - 34a5065425f1e014b5ae318a681f499bf6b05bf7b9a08f15546ae8d4eccb4339
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\python.exe - cb31d0c0ebdf1c73ee774381007e393136598c00fd7a50aae9e6324ed08553e5
C:\Program Files\LibreOffice\program\unopkg.exe - 28d8808cf786fdb5ceb0afdefb9560b27c2f7c4904124f92406690ca786dc3e3
C:\Program Files\LibreOffice\program\simpress.exe - 3fda867b817706c8cb077f09efafa32a041a59fbd7046d3dd5d87f356d50fd6f
C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - 369466f5e783a6b84bb34c1596c550f9c9ba1fd8d2695fe83e7515c13dbfdcfd
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428
C:\Program Files\LibreOffice\program\regview.exe - 1643fa8f048197af2eac31cc559651ec446aed2fdc281e443070cdd3c18076da
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - bbd721b7212db30cdf7d3c15d28476ab7e0518087a2ffdf02bdf7645d26a2e9c
C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe - dc8bb2d3c56ca94ca697a9f8a8028e3829d7590ab1ca1e69a7e1183282a4e0d5
C:\Windows\virDll.dll - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - e68f7f404c71b8eb3627ce1c0850e6baf7d3eb77bbecc2a698720b00990e0fa0
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-32.exe - 05b7ba64c470fe9ff40ab4426c64321a16931b0c3b67f1d6fd4114632e2fe0f1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

wntmsci12.pro

Embedded IP addresses

192.168.0.30
192.168.8.1
20.247.184.197
20.184.175.6
4.230.171.124
4.247.188.233
104.18.33.89
74.178.76.54
172.215.188.232
4.150.223.106
74.178.240.61
162.159.142.9
135.234.160.244
20.184.175.10
4.150.223.109
52.110.12.25
52.110.12.38
92.223.78.30
72.154.7.109
52.148.114.188

File paths

C:\Source\openoffice\main\desktop\wntmsci12.pro\bin\rebasegui.pdb

More Lamer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report