Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 11, 2024, 10:44 a.m.	Jan. 11, 2024, 10:46 a.m.

Size	9.9MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`d6827143dea10743fbe533e6430574e8`
SHA256	`b9b792eef060b62674faea5762450e74a5764ed70c96acbd549e5af589bdcf1b`
CRC32	`6E54C40C`
ssdeep	`98304:IQuo2XXjDP5FgIaMWDg6kyELQbzDINDReyP3r2sQbgqWf1dWoAxg6/3Ta62mGbC6:dMXXjdmIaMWDg6kyEUzkN96poKDmC6`
PDB Path	æ´ ± ¥³xbT5/kÈ£kÄ¸jÎÒámqäº0¦}ªààuþisâm©îÔìÃÉìYK#wí¹ºÐÏÏ+ùòC(
Yara	Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Malicious_Packer_Zero - Malicious Packer PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

LUMMA.exe "C:\Users\test22\AppData\Local\Temp\LUMMA.exe"
2560

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 11, 2024, 10:44 a.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW Jan. 11, 2024, 10:44 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 11, 2024, 10:44 a.m.			0	0
IsDebuggerPresent Jan. 11, 2024, 10:44 a.m.			0	0
IsDebuggerPresent Jan. 11, 2024, 10:44 a.m.			0	0
IsDebuggerPresent Jan. 11, 2024, 10:44 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 11, 2024, 10:44 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x012b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01410000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02d20000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ef0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e45000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e4b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e47000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01070000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 11, 2024, 10:44 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00e1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	IL:Trojan.MSILZilla.30386
Skyhigh	Artemis
McAfee	Artemis!D6827143DEA1
Sangfor	Trojan.Win32.Agent.Vvrl
K7AntiVirus	Trojan ( 005b019f1 )
Alibaba	Trojan:MSIL/Formbook.1447f674
K7GW	Trojan ( 005b019f1 )
Cybereason	malicious.6189f9
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.AKMO
BitDefender	IL:Trojan.MSILZilla.30386
Avast	Win32:DropperX-gen [Drp]
Tencent	Win32.Trojan.FalseSign.Hplw
F-Secure	Trojan.TR/Kryptik.jjfrt
DrWeb	Trojan.Packed2.46128
VIPRE	IL:Trojan.MSILZilla.30386
TrendMicro	TrojanSpy.Win32.LUMMASTEALER.YXEAGZ
Emsisoft	IL:Trojan.MSILZilla.30386 (B)
Google	Detected
Avira	TR/Kryptik.jjfrt
Antiy-AVL	Trojan/Win32.Wacatac
Microsoft	Trojan:MSIL/Formbook.NN!MTB
Gridinsoft	Trojan.Win32.Agent.sa
Arcabit	IL:Trojan.MSILZilla.D76B2
GData	IL:Trojan.MSILZilla.30386
Cynet	Malicious (score: 99)
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TrojanSpy.Win32.LUMMASTEALER.YXEAGZ
Rising	Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:g8EPXTHj1JvKoi59t4RQwQ)
Ikarus	Trojan.MSIL.AgentTesla
Fortinet	PossibleThreat
AVG	Win32:DropperX-gen [Drp]
DeepInstinct	MALICIOUS

LUMMA.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All