lumma | c12a928622888460689dbb5e4325f50643a6410800b7f956e4acbb58ad880f3a

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

pct_free_installer_20231219.1-100000.exe
Size

2.8MB
MD5

05eb05252788c2d1378ec2d801360cca
SHA1

b90b65df0ef136a67d4c9dc7a3bf7a9c0d9b5375
SHA256

8fdafd89fbea6d568a93eb957157c3fd795c9017f661973005d4ba91f661ebcb
SHA512

361349a6735ff72d1409154c921af0c420c115b7f0f4cc620863e8165a1d388b5be0916e64bc113caf4d3972bd132ecaf342a6f9a21d5c8f8ccd81605a53d7cc
SSDEEP

49152:bZC7YH8WUbAwrcgn8d8HMjF5srtQEw9H0+VCjyYcgn8d8HMy:bZC5brcg804F5srtQU+IjyYcg80/

Score

10^/10

lumma zgrat rat stealer

Malware Config

Signatures

Detect Lumma Stealer payload V4 2 IoCs

resource	yara_rule
behavioral2/memory/628-944-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4
behavioral2/memory/628-946-0x0000000000400000-0x000000000047E000-memory.dmp	family_lumma_v4

Detect ZGRat V1 33 IoCs

resource	yara_rule
behavioral2/memory/4552-7-0x0000000007600000-0x00000000076D2000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-8-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-9-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-11-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-13-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-15-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-17-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-19-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-21-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-23-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-25-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-27-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-29-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-31-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-33-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-35-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-37-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-39-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-41-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-43-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-45-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-47-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-49-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-51-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-53-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-55-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-57-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-59-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-61-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-63-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-65-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-67-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1
behavioral2/memory/4552-69-0x0000000007600000-0x00000000076CB000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4552 set thread context of 628	4552	pct_free_installer_20231219.1-100000.exe	93

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	pct_free_installer_20231219.1-100000.exe
4552	pct_free_installer_20231219.1-100000.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4552	pct_free_installer_20231219.1-100000.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93
PID 4552 wrote to memory of 628	4552	pct_free_installer_20231219.1-100000.exe	93

C:\Users\Admin\AppData\Local\Temp\pct_free_installer_20231219.1-100000.exe
"C:\Users\Admin\AppData\Local\Temp\pct_free_installer_20231219.1-100000.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  2⤵
  PID:628

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/628-944-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/628-946-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/4552-43-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-23-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-6-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4552-7-0x0000000007600000-0x00000000076D2000-memory.dmp

Filesize
840KB

Download
memory/4552-8-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-9-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-11-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-13-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-15-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-17-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-19-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-21-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-45-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-25-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-27-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-29-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-31-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-33-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-35-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-37-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-39-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-41-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-5-0x0000000005180000-0x0000000005268000-memory.dmp

Filesize
928KB

Download
memory/4552-0-0x0000000002380000-0x0000000002467000-memory.dmp

Filesize
924KB

Download
memory/4552-61-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-49-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-51-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-53-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-55-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-57-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-59-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-47-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-63-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-65-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-67-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-69-0x0000000007600000-0x00000000076CB000-memory.dmp

Filesize
812KB

Download
memory/4552-930-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4552-931-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/4552-932-0x00000000076D0000-0x000000000773A000-memory.dmp

Filesize
424KB

Download
memory/4552-933-0x0000000007740000-0x000000000778C000-memory.dmp

Filesize
304KB

Download
memory/4552-934-0x0000000002380000-0x0000000002467000-memory.dmp

Filesize
924KB

Download
memory/4552-935-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/4552-936-0x0000000007AE0000-0x0000000008084000-memory.dmp

Filesize
5.6MB

Download
memory/4552-943-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4552-4-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4552-945-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download
memory/4552-3-0x0000000074610000-0x0000000074DC0000-memory.dmp

Filesize
7.7MB

Download