popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Luma.exe

Generic Malware Malicious Library UPX ScreenShot AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 31, 2024, 6:02 p.m. Oct. 31, 2024, 6:11 p.m.
Size 649.5KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 998c59d4bf9c18e798a6db77f7ce10f9
SHA256 e0d3da58a38b98b5d9ba1241fb1b30d7251332883b285117e6d2794af0c66394
CRC32 23496503
ssdeep 12288:3KbQTjM37Fhgr4ZNkE1Er41iaNhqqitQ+jHKVkdvXPg9O/1ACWFtIW5NcDU:nTY37wr4ZyprDGqqitSkxPg41XgtR5Wo
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .00cfg
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
luma+0x7afa @ 0x9f7afa

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 3209904
registers.edi: 4247728
registers.eax: 1
registers.ebp: 3209976
registers.edx: 2130566132
registers.ebx: 68
registers.esi: 4128768
registers.ecx: 2146631680
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2572
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a3e000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0003ee00', u'virtual_address': u'0x00001000', u'entropy': 7.024062290351813, u'name': u'.text', u'virtual_size': u'0x0003ec7f'} entropy 7.02406229035 description A section with a high entropy has been found
section {u'size_of_data': u'0x00051c00', u'virtual_address': u'0x00057000', u'entropy': 7.999515451399281, u'name': u'.bss', u'virtual_size': u'0x00051c00'} entropy 7.9995154514 description A section with a high entropy has been found
entropy 0.89274691358 description Overall entropy of this PE file is high
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0x00000000
process_identifier: 2724
process_handle: 0x0000002c
0 0

NtTerminateProcess

 status_code: 0x00000000
process_identifier: 2724
process_handle: 0x0000002c
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2724
region_size: 385024
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
3221225496 0

NtAllocateVirtualMemory

 process_identifier: 2760
region_size: 385024
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000040
1 0 0
Process injection Process 2572 manipulating memory of non-child process 2724
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2724
region_size: 385024
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
3221225496 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL§Ígà DÔ°Ð@à@…R€Œ€Kœ¼.text¸BD `.rdata'%`&H@@.dataõbn@À.reloc€KLÐ@B
base_address: 0x00400000
process_identifier: 2760
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2760
process_handle: 0x00000040
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL§Ígà DÔ°Ð@à@…R€Œ€Kœ¼.text¸BD `.rdata'%`&H@@.dataõbn@À.reloc€KLÐ@B
base_address: 0x00400000
process_identifier: 2760
process_handle: 0x00000040
1 1 0
Process injection Process 2572 called NtSetContextThread to modify thread in remote process 2760
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1964628
registers.edi: 0
registers.eax: 4247728
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000044
process_identifier: 2760
1 0 0
Process injection Process 2572 resumed a thread in remote process 2760
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000044
suspend_count: 1
process_identifier: 2760
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2728
thread_handle: 0x00000020
process_identifier: 2724
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\Luma.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\Luma.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000002c
1 1 0

NtGetContextThread

 thread_handle: 0x00000020
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2724
region_size: 385024
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000002c
3221225496 0

CreateProcessInternalW

 thread_identifier: 2764
thread_handle: 0x00000044
process_identifier: 2760
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\Luma.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\Luma.exe
stack_pivoted: 0
creation_flags: 4 (CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000040
1 1 0

NtGetContextThread

 thread_handle: 0x00000044
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2760
region_size: 385024
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000040
1 0 0

WriteProcessMemory

 buffer: MZx@xº´ Í!¸LÍ!This program cannot be run in DOS mode.$PEL§Ígà DÔ°Ð@à@…R€Œ€Kœ¼.text¸BD `.rdata'%`&H@@.dataõbn@À.reloc€KLÐ@B
base_address: 0x00400000
process_identifier: 2760
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2760
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00446000
process_identifier: 2760
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00449000
process_identifier: 2760
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00459000
process_identifier: 2760
process_handle: 0x00000040
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2760
process_handle: 0x00000040
1 1 0

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1964628
registers.edi: 0
registers.eax: 4247728
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000044
process_identifier: 2760
1 0 0

NtResumeThread

 thread_handle: 0x00000044
suspend_count: 1
process_identifier: 2760
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Injuke.16!c
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Trojan.jc
ALYac Gen:Variant.Zusy.565268
Cylance Unsafe
CrowdStrike win/malicious_confidence_90% (D)
BitDefender Gen:Variant.Lazy.620510
Arcabit Trojan.Zusy.D8A014
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/GenKryptik.HDGW
APEX Malicious
Avast Win32:Evo-gen [Trj]
Kaspersky HEUR:Trojan.Win32.Stelpak.gen
MicroWorld-eScan Gen:Variant.Lazy.620510
Rising Trojan.Kryptik@AI.94 (RDML:o3r0FvhuatNFq71W0HHCVA)
Emsisoft Gen:Variant.Lazy.620510 (B)
McAfeeD ti!E0D3DA58A38B
Trapmine malicious.moderate.ml.score
CTX exe.trojan.kryptik
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.998c59d4bf9c18e7
Google Detected
Antiy-AVL GrayWare/Win32.Kryptik.gpyt
Kingsoft Win32.HeurC.KVMH008.a
Gridinsoft Spy.Win32.Gen.tr
Microsoft Trojan:Win32/Znyonm
GData Gen:Variant.Lazy.620510
Varist W32/ABTrojan.EMBC-5628
AhnLab-V3 Trojan/Win.Injection.C5689201
McAfee Artemis!998C59D4BF9C
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.3907059518
Ikarus Win32.Outbreak
Panda Trj/Genetic.gen
Fortinet W32/PossibleThreat
AVG Win32:Evo-gen [Trj]
Paloalto generic.ml
alibabacloud Trojan:Win/Wacapew.C9nj