lumma | a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b

Analysis

max time kernel
75s
max time network
188s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
04-03-2024 05:02

Target

a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe
Size

499KB
MD5

764f801b0842d8fe564f01a81cfe4526
SHA1

d3cd929c42f808c1ddfdef4d8b528f1e1d981bba
SHA256

a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b
SHA512

5019550b6c11df7f466531f0564d6f7bfb214a92f0d508bc631e8f0a39b38a4c09611241b87bc74f509e9851c68657363d77d93436b8b2c604d9ed6e6202dc21
SSDEEP

12288:OvnWvqHe7UF6q12BlW7872GOXYtKFlK1CJsIk:UWvUGBlW787+zK1jD

Score

10^/10

Family

lumma

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/1304-0-0x0000000000890000-0x0000000000914000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1304 set thread context of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 3976	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	74
PID 1304 wrote to memory of 3976	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	74
PID 1304 wrote to memory of 3976	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	74
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75
PID 1304 wrote to memory of 4100	1304	a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe	75

C:\Users\Admin\AppData\Local\Temp\a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe
"C:\Users\Admin\AppData\Local\Temp\a209c55478f217066ba1babd44459d2b0a4da6ed90aa5928280eaf6ac2f0457b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:4100

memory/1304-0-0x0000000000890000-0x0000000000914000-memory.dmp

Filesize
528KB

Download
memory/1304-1-0x00000000731D0000-0x00000000738BE000-memory.dmp

Filesize
6.9MB

Download
memory/1304-9-0x00000000731D0000-0x00000000738BE000-memory.dmp

Filesize
6.9MB

Download
memory/1304-10-0x0000000002B70000-0x0000000004B70000-memory.dmp

Filesize
32.0MB

Download
memory/1304-13-0x0000000002B70000-0x0000000004B70000-memory.dmp

Filesize
32.0MB

Download
memory/4100-4-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4100-8-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4100-12-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4100-11-0x0000000000C40000-0x0000000000C41000-memory.dmp

Filesize
4KB

Download