Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 21, 2025, 4:27 p.m.	Feb. 21, 2025, 4:30 p.m.

Size	15.8MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`0c38e5cacc997db36aeb4678c1ddf3bc`
SHA256	`62c09b2435ff52e29a56f8474f6307084383d73ecbf5dc62bd9767a23d50ec39`
CRC32	`B1F846F7`
ssdeep	`393216:Pkcbf0j8aPknFM7mqF6WEuDLEXgqqIv1MCNrrPgLX3wRHyNn:ccj0PPknFymqXE8gXKkJrPgL6SZ`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Antivirus - Contains references to security software Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file

lem.exe "C:\Users\test22\AppData\Local\Temp\lem.exe"
2556
- lem.tmp "C:\Users\test22\AppData\Local\Temp\is-7M6B2.tmp\lem.tmp" /SL5="$80178,15291586,119296,C:\Users\test22\AppData\Local\Temp\lem.exe"
  2620
  - lem.exe "C:\Users\test22\AppData\Local\Temp\lem.exe" /VERYSILENT
    2744
    - lem.tmp "C:\Users\test22\AppData\Local\Temp\is-BQDMK.tmp\lem.tmp" /SL5="$90178,15291586,119296,C:\Users\test22\AppData\Local\Temp\lem.exe" /VERYSILENT
      2792
      - Start10ThemeEdit.exe "C:\Users\test22\AppData\Roaming\{2836644D-224C-4C95-892D-5D57DDC11073}\Start10ThemeEdit.exe" allodial.a3x
        2948
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW Feb. 21, 2025, 4:28 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 21, 2025, 4:27 p.m.			0	0
IsDebuggerPresent Feb. 21, 2025, 4:27 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Feb. 21, 2025, 4:27 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Feb. 21, 2025, 4:27 p.m.	stacktrace: lem+0xe2bed @ 0x4e2bed lem+0x1000fa @ 0x5000fa BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7597b727 registers.esp: 1637828 registers.edi: 4891672 registers.eax: 1637828 registers.ebp: 1637908 registers.edx: 0 registers.ebx: 5123053 registers.esi: 2 registers.ecx: 7	1	0	0
__exception__ Feb. 21, 2025, 4:28 p.m.	stacktrace: 0x711d66 0x711429 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: ff 10 83 ec 10 85 c0 78 06 8b bd d4 fd ff ff 8d exception.instruction: call dword ptr [eax] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x711fda registers.esp: 36108944 registers.edi: 0 registers.eax: 0 registers.ebp: 36109544 registers.edx: 37 registers.ebx: 36109000 registers.esi: 36109592 registers.ecx: 36109592	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2620 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2620 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 21, 2025, 4:29 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 69632 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0041b000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2744 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74142000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74142000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 21, 2025, 4:27 p.m.	process_identifier: 2792 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Feb. 21, 2025, 4:28 p.m.	process_identifier: 2948 region_size: 102400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00710000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

Creates executable files on the filesystem (6 events)

file	C:\Users\test22\AppData\Local\Temp\is-NUUPI.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-262AO.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-262AO.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-NUUPI.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-262AO.tmp\_isetup\_iscrypt.dll
file	C:\Users\test22\AppData\Local\Temp\is-NUUPI.tmp\_isetup\_iscrypt.dll

Drops an executable to the user AppData folder (4 events)

file	C:\Users\test22\AppData\Local\Temp\is-NUUPI.tmp\_isetup\_isdecmp.dll
file	C:\Users\test22\AppData\Local\Temp\is-NUUPI.tmp\_isetup\_shfoldr.dll
file	C:\Users\test22\AppData\Local\Temp\is-7M6B2.tmp\lem.tmp
file	C:\Users\test22\AppData\Local\Temp\is-NUUPI.tmp\_isetup\_iscrypt.dll

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Feb. 21, 2025, 4:27 p.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\lem.exe parameters: /VERYSILENT filepath: C:\Users\test22\AppData\Local\Temp\lem.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (36 events)

Time & API	Arguments	Status	Return
Process32FirstW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: System process_identifier: 4	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: smss.exe process_identifier: 224	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: csrss.exe process_identifier: 304	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: wininit.exe process_identifier: 352	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: csrss.exe process_identifier: 360	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: winlogon.exe process_identifier: 400	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: services.exe process_identifier: 444	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: lsass.exe process_identifier: 460	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: lsm.exe process_identifier: 468	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 572	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 652	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 724	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 784	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 832	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: audiodg.exe process_identifier: 900	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 992	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 292	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: spoolsv.exe process_identifier: 324	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 1048	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: srvany.exe process_identifier: 1284	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: KMService.exe process_identifier: 1436	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: conhost.exe process_identifier: 1448	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: taskhost.exe process_identifier: 1600	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: sppsvc.exe process_identifier: 1820	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: svchost.exe process_identifier: 1896	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: dwm.exe process_identifier: 1260	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: explorer.exe process_identifier: 1452	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: pw.exe process_identifier: 988	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: SearchIndexer.exe process_identifier: 1160	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: SearchProtocolHost.exe process_identifier: 936	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: SearchFilterHost.exe process_identifier: 2000	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: pw.exe process_identifier: 2328	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: taskhost.exe process_identifier: 2380	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: lem.exe process_identifier: 2744	1	1
Process32NextW Feb. 21, 2025, 4:28 p.m.	snapshot_handle: 0x000001f4 process_name: lem.tmp process_identifier: 2792	1	1

Queries for potentially installed applications (2 events)

Time & API	Arguments	Status	Return	Repeated
RegOpenKeyExW Feb. 21, 2025, 4:27 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Start10ThemeEdit_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Start10ThemeEdit_is1		2	0
RegOpenKeyExW Feb. 21, 2025, 4:27 p.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Start10ThemeEdit_is1 base_handle: 0x80000002 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Start10ThemeEdit_is1		2	0

File has been identified by 14 AntiVirus engines on VirusTotal as malicious (14 events)

Bkav	W32.AIDetectMalware
Skyhigh	Artemis!Trojan
Cylance	Unsafe
CrowdStrike	win/grayware_confidence_90% (D)
ESET-NOD32	a variant of Win32/TrojanDropper.Agent.TAT
McAfeeD	ti!62C09B2435FF
Kingsoft	Win32.Troj.Undef.a
Gridinsoft	Spy.Win32.Vidar.tr
AhnLab-V3	Trojan/Win.Agent.C5732418
McAfee	Artemis!0C38E5CACC99
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Dropper
Ikarus	Trojan-Spy.Win32.LummaStealer
Fortinet	W32/Agent.TAT!tr

lem.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All