lumma | c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276

General

Target

c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe
Size

5.1MB
MD5

7f4f98a26d4835578f46224112cc6a15
SHA1

c5cbaf07ef86ee77e7a079ece95e749e7b93a0f0
SHA256

c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276
SHA512

c2fe13271b35c799ea871b54f0d73a61a2ceed5b4f8fa7464bc758908f35185bfe1c43d38c54941c9fef18284334d61ddab506121d7d993ec87752a77eea8c5b
SSDEEP

49152:P+YP67CyHtopnQluz8CTtagvrvdNVELjMmPQt+yJQ1EErwVeCbrrqe8t6WmfFXAA:02YtaHDvdXEvPgwtTCo6R9wJLYtk+L/j

Score

10^/10

Malware Config

Signatures

Detect Lumma Stealer payload V4 6 IoCs

resource	yara_rule
behavioral1/memory/2600-38-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4
behavioral1/memory/2600-37-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4
behavioral1/memory/2600-35-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4
behavioral1/memory/2600-31-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4
behavioral1/memory/2600-29-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4
behavioral1/memory/2600-40-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/1920-0-0x0000000000940000-0x0000000000E54000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	2600	WerFault.exe	28

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 1920 wrote to memory of 2600	1920	c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe	28
PID 2600 wrote to memory of 2716	2600	RegSvcs.exe	29
PID 2600 wrote to memory of 2716	2600	RegSvcs.exe	29
PID 2600 wrote to memory of 2716	2600	RegSvcs.exe	29
PID 2600 wrote to memory of 2716	2600	RegSvcs.exe	29

C:\Users\Admin\AppData\Local\Temp\c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe
"C:\Users\Admin\AppData\Local\Temp\c20f57c4db1ec145b3f2131677c80e8ceb88b11b81dbb1e7bf84983daf514276.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 212
    3⤵
    - Program crash
    PID:2716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
79KB

MD5
bab3807ca1fa06a7e1ca825241f69abd

SHA1
91473f7f9001b4e24a3b3f7382ad3b989259bc7a

SHA256
481c08af93203726c467efddf6dc3e45898078c3189b57308937c6adfd571dd2

SHA512
cb6088c656f386f76d203408ac6cd208d12a6e449914b2c4596d7e2ceffd1078e04131c44ed66a9c11e296a016299cfe9ac3a5f549c00ff0117eee4ec743a5f6

Download Submit
memory/1920-16-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-21-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-3-0x0000000005760000-0x0000000005988000-memory.dmp

Filesize
2.2MB

Download
memory/1920-4-0x0000000006AC0000-0x0000000006C52000-memory.dmp

Filesize
1.6MB

Download
memory/1920-14-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-19-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-22-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-39-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1920-0-0x0000000000940000-0x0000000000E54000-memory.dmp

Filesize
5.1MB

Download
memory/1920-9-0x0000000000800000-0x0000000000810000-memory.dmp

Filesize
64KB

Download
memory/1920-10-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-11-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-12-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-15-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-2-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-1-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1920-13-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/1920-20-0x00000000748C0000-0x0000000074FAE000-memory.dmp

Filesize
6.9MB

Download
memory/1920-18-0x0000000007200000-0x0000000007300000-memory.dmp

Filesize
1024KB

Download
memory/1920-17-0x00000000004C0000-0x0000000000500000-memory.dmp

Filesize
256KB

Download
memory/2600-23-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-27-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-25-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-29-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-31-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-35-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-37-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-38-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/2600-40-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download

Analysis

Sharing