lumma | c12a928622888460689dbb5e4325f50643a6410800b7f956e4acbb58ad880f3a

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20-12-2023 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pct_free_installer_20231219.1-100000.exe
Size

2.8MB
MD5

05eb05252788c2d1378ec2d801360cca
SHA1

b90b65df0ef136a67d4c9dc7a3bf7a9c0d9b5375
SHA256

8fdafd89fbea6d568a93eb957157c3fd795c9017f661973005d4ba91f661ebcb
SHA512

361349a6735ff72d1409154c921af0c420c115b7f0f4cc620863e8165a1d388b5be0916e64bc113caf4d3972bd132ecaf342a6f9a21d5c8f8ccd81605a53d7cc
SSDEEP

49152:bZC7YH8WUbAwrcgn8d8HMjF5srtQEw9H0+VCjyYcgn8d8HMy:bZC5brcg804F5srtQU+IjyYcg80/

Score

10^/10

lumma zgrat rat stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 2 IoCs

resource	yara_rule
behavioral1/memory/3060-952-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4
behavioral1/memory/3060-954-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral1/memory/2416-7-0x0000000007230000-0x0000000007302000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-8-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-9-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-13-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-15-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-11-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-21-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-19-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-17-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-27-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-25-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-23-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-31-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-29-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-33-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-35-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-37-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-39-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-41-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-43-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-45-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-49-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-47-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-51-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-53-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-55-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-57-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-59-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-61-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-63-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-65-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-67-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1
behavioral1/memory/2416-69-0x0000000007230000-0x00000000072FB000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2416 set thread context of 3060	2416	pct_free_installer_20231219.1-100000.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2416	pct_free_installer_20231219.1-100000.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	pct_free_installer_20231219.1-100000.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30
PID 2416 wrote to memory of 3060	2416	pct_free_installer_20231219.1-100000.exe	30

C:\Users\Admin\AppData\Local\Temp\pct_free_installer_20231219.1-100000.exe
"C:\Users\Admin\AppData\Local\Temp\pct_free_installer_20231219.1-100000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2⤵
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000002050000-0x0000000002137000-memory.dmp

Filesize
924KB

Download
memory/2416-1-0x0000000002050000-0x0000000002137000-memory.dmp

Filesize
924KB

Download
memory/2416-3-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-5-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/2416-4-0x0000000004DB0000-0x0000000004E98000-memory.dmp

Filesize
928KB

Download
memory/2416-6-0x0000000004C80000-0x0000000004CC0000-memory.dmp

Filesize
256KB

Download
memory/2416-7-0x0000000007230000-0x0000000007302000-memory.dmp

Filesize
840KB

Download
memory/2416-8-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-9-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-13-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-15-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-11-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-21-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-19-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-17-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-27-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-25-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-23-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-31-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-29-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-33-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-35-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-37-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-39-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-41-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-43-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-45-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-49-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-47-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-51-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-53-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-55-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-57-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-59-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-61-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-63-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-65-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-67-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-69-0x0000000007230000-0x00000000072FB000-memory.dmp

Filesize
812KB

Download
memory/2416-930-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/2416-931-0x00000000077F0000-0x000000000785A000-memory.dmp

Filesize
424KB

Download
memory/2416-932-0x0000000007860000-0x00000000078AC000-memory.dmp

Filesize
304KB

Download
memory/2416-933-0x0000000002050000-0x0000000002137000-memory.dmp

Filesize
924KB

Download
memory/2416-934-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/2416-953-0x0000000074360000-0x0000000074A4E000-memory.dmp

Filesize
6.9MB

Download
memory/3060-952-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/3060-954-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download