lumma | 18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492

Analysis

max time kernel
198s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240221-en
resource tags

arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
submitted
11-03-2024 00:13

Target

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe
Size

468KB
MD5

40dd510795e82f9a51301896809c2d95
SHA1

5bc4f3a04dae16cd6c69dd442551a795c9caa9ef
SHA256

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492
SHA512

c2fa10356790136e1bacbf0bc26eb015d6ceae49d2fb953fc80cb3085375d050000b2672cf15bc97fd633a31e6012e0fe47e282f31a614192840f85624b693c8
SSDEEP

6144:sR0tQjTAMFGf1nAB9/huXDttKkDklFuktsferJ/f7UF3HfuXeZWquoQ:sRK1y5IDnKkDxkme5f6HfuurHQ

Score

10^/10

Family

lumma

https://associationokeo.shop/api

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/212-0-0x0000000000DD0000-0x0000000000E46000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe

description	pid	process	target process
PID 212 set thread context of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe

description	pid	process	target process
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe
PID 212 wrote to memory of 512	212	18f17375402cffe877271fdeedb0e78ebf492ba954da3bfcbc742fd5fd567492.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:512

memory/212-0-0x0000000000DD0000-0x0000000000E46000-memory.dmp

Filesize
472KB

Download
memory/212-1-0x0000000073540000-0x0000000073C2E000-memory.dmp

Filesize
6.9MB

Download
memory/212-2-0x00000000057E0000-0x00000000057F0000-memory.dmp

Filesize
64KB

Download
memory/212-11-0x0000000073540000-0x0000000073C2E000-memory.dmp

Filesize
6.9MB

Download
memory/212-10-0x0000000003210000-0x0000000005210000-memory.dmp

Filesize
32.0MB

Download
memory/212-14-0x0000000003210000-0x0000000005210000-memory.dmp

Filesize
32.0MB

Download
memory/512-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/512-8-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/512-12-0x0000000001260000-0x0000000001261000-memory.dmp

Filesize
4KB

Download
memory/512-13-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download