Analysis
- max time kernel
146s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240221-en - resource tags
- submitted
25/02/2024, 12:29
General
- Target file.exe
- Size 7.0MB
- Sample240225-pnwsrscc4y
- SHA256 fb649af245b195baa02a4790f237b4c7dad4d9a116ab10ec5fdb9be45dbd628a
Malware Config
Extracted
-
lumma
-
https://fieldtrollyeowskwe.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
Signatures
- Detect ZGRat V1 1 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- ZGRat
ZGRat is remote access trojan written in C#.
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Protect544cd51a.dll
memory/2032-35-0x0000000000400000-0x0000000000449000-memory.dmp
memory/2032-32-0x00000000024E0000-0x00000000024F0000-memory.dmp
memory/2032-34-0x00000000024F0000-0x0000000002522000-memory.dmp
memory/2032-33-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/2032-31-0x0000000002690000-0x0000000002691000-memory.dmp
memory/2032-30-0x0000000000400000-0x0000000000449000-memory.dmp
memory/2032-28-0x0000000000400000-0x0000000000449000-memory.dmp
memory/2032-25-0x0000000000400000-0x0000000000449000-memory.dmp
memory/4612-7-0x00000000064C0000-0x0000000006A64000-memory.dmp
memory/4612-24-0x00000000082C0000-0x00000000083C0000-memory.dmp
memory/4612-9-0x0000000007A70000-0x0000000007D2E000-memory.dmp
memory/4612-17-0x0000000006000000-0x0000000006010000-memory.dmp
memory/4612-16-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-18-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-19-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-20-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-21-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-23-0x00000000082C0000-0x00000000083C0000-memory.dmp
memory/4612-22-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-10-0x0000000007D30000-0x0000000007EC2000-memory.dmp
memory/4612-8-0x0000000006030000-0x00000000060C2000-memory.dmp
memory/4612-29-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/4612-0-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/4612-6-0x0000000005B80000-0x0000000005ED4000-memory.dmp
memory/4612-5-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-4-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/4612-3-0x0000000003220000-0x0000000003230000-memory.dmp
memory/4612-2-0x0000000005870000-0x000000000590C000-memory.dmp
memory/4612-1-0x0000000000790000-0x0000000000E90000-memory.dmp