Analysis
- max time kernel
147s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
27/02/2024, 22:31
General
- Target Razer Installer.exe
- Size 8.6MB
- Sample240227-2fqyrsdc4v
- SHA256 43242c65da9a98e0b14719b801a4a999214645da2fafe0590d9424b2b7bfbea9
Malware Config
Extracted
-
lumma
-
https://mutterunlikelyoo.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
Signatures
- Detect ZGRat V1 34 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Razer Installer.exe"C:\Users\Admin\AppData\Local\Temp\Razer Installer.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/8-40-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-1122-0x0000000005CF0000-0x0000000005D42000-memory.dmp
memory/8-2-0x00000000057D0000-0x00000000057E0000-memory.dmp
memory/8-3-0x00000000057E0000-0x00000000058A8000-memory.dmp
memory/8-4-0x00000000058B0000-0x000000000597A000-memory.dmp
memory/8-5-0x0000000005FA0000-0x00000000065B8000-memory.dmp
memory/8-6-0x0000000005AE0000-0x0000000005BEA000-memory.dmp
memory/8-7-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-8-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-10-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-12-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-14-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-16-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-18-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-20-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-22-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-24-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-26-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-28-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-30-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-32-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-34-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-36-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-38-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-1-0x0000000000D30000-0x0000000000E28000-memory.dmp
memory/8-44-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-0-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/8-46-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-48-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-50-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-52-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-54-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-56-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-58-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-60-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-62-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-64-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-66-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-68-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-70-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-1121-0x0000000005A20000-0x0000000005A21000-memory.dmp
memory/8-42-0x00000000058B0000-0x0000000005973000-memory.dmp
memory/8-1123-0x0000000005D60000-0x0000000005DAC000-memory.dmp
memory/8-1124-0x0000000006BD0000-0x0000000007174000-memory.dmp
memory/8-1132-0x0000000074550000-0x0000000074D00000-memory.dmp
memory/3368-1130-0x0000000000400000-0x0000000000449000-memory.dmp
memory/3368-1131-0x0000000000920000-0x0000000000952000-memory.dmp
memory/3368-1129-0x0000000000400000-0x0000000000449000-memory.dmp
memory/3368-1133-0x0000000000920000-0x0000000000952000-memory.dmp