lumma | 901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879

General

Target

901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe
Size

6.7MB
MD5

04474486e533db51f7f1ff0f8719a062
SHA1

0ff77213cc09ff09381980bc9df5dd3f0ca96131
SHA256

901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879
SHA512

6833d094af2654319561335eed7a79ef5e0f0726877bde5de68d201977552bc710bf046e2857e80aa462e0baf73487a74433e566759dfaca8c37b474cd7c2868
SSDEEP

98304:x6hItKsKxu0hQCmgKec8oLsLS7gf07eA7LUC/yY6:whItKrw0hRcN4kgRCaT

Score

10^/10

lumma zgrat rat stealer

Malware Config

Extracted

Family

lumma

C2

https://woodfeetumhblefepoj.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/4520-1-0x00000000000D0000-0x0000000000786000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Loads dropped DLL 1 IoCs

pid	Process
4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4520 set thread context of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4520 wrote to memory of 3132	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	100
PID 4520 wrote to memory of 3132	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	100
PID 4520 wrote to memory of 3132	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	100
PID 4520 wrote to memory of 4424	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	102
PID 4520 wrote to memory of 4424	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	102
PID 4520 wrote to memory of 4424	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	102
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101
PID 4520 wrote to memory of 4136	4520	901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe	101

C:\Users\Admin\AppData\Local\Temp\901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe
"C:\Users\Admin\AppData\Local\Temp\901610c36cdd51920d427192db07c9eb8f0d2476b5e0c537fbb452492008e879.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:3132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:4136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
  2⤵
  PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4012 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:4612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll

Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/4136-33-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/4136-32-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4136-29-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/4136-31-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/4136-23-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4136-27-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4136-28-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/4136-25-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4520-7-0x0000000006520000-0x0000000006B38000-memory.dmp

Filesize
6.1MB

Download
memory/4520-22-0x0000000007D40000-0x0000000007E40000-memory.dmp

Filesize
1024KB

Download
memory/4520-15-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4520-16-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4520-17-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4520-18-0x0000000001030000-0x0000000001040000-memory.dmp

Filesize
64KB

Download
memory/4520-19-0x0000000007D40000-0x0000000007E40000-memory.dmp

Filesize
1024KB

Download
memory/4520-20-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4520-21-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4520-9-0x0000000000E60000-0x0000000000FF2000-memory.dmp

Filesize
1.6MB

Download
memory/4520-8-0x0000000005F00000-0x00000000061F2000-memory.dmp

Filesize
2.9MB

Download
memory/4520-0-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4520-6-0x00000000059D0000-0x0000000005EFC000-memory.dmp

Filesize
5.2MB

Download
memory/4520-5-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4520-30-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4520-4-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4520-3-0x0000000005290000-0x000000000532C000-memory.dmp

Filesize
624KB

Download
memory/4520-2-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/4520-1-0x00000000000D0000-0x0000000000786000-memory.dmp

Filesize
6.7MB

Download

Analysis

Sharing