lumma | 9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea

Analysis

max time kernel
155s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 02:30

Target

9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe
Size

470KB
MD5

9e203e42aad4a23d95bddec9509f4d72
SHA1

14726a881fc956c8d3450c580da6c9b921c38bd6
SHA256

9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea
SHA512

a1add22c1fd88653a1ecfc78d708e425f9dd7e1be4b286c5d2a69994c6f46d45e16b4ceb95fd6524cfcf72742145b2588b0f90344339827d2e4e83135d7e700a
SSDEEP

6144:yuwf0+RecrdM5x4z+TLonB3MRQ0+sCOMysnHLs7kSRqebpXbq4Hy6m51py:nUyLCBckT8sHLsBqebpJH5mc

Score

10^/10

Family

lumma

https://scrapedirtyieoqk.shop/api

https://associationokeo.shop/api

Detect ZGRat V1 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/908-1-0x0000000000140000-0x00000000001B6000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

Processes:

9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe

description	pid	process	target process
PID 908 set thread context of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4676 4444 WerFault.exe RegAsm.exe

pid	pid_target	process	target process
4676	4444	WerFault.exe	RegAsm.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe

description	pid	process	target process
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe
PID 908 wrote to memory of 4444	908	9dcd2325222229aee939e07986dfd5eac660a3ad129979597707569af979ffea.exe	RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1216
3⤵
- Program crash
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4444 -ip 4444
1⤵
PID:1608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3920 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:1692

memory/908-0-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/908-1-0x0000000000140000-0x00000000001B6000-memory.dmp

Filesize
472KB

Download
memory/908-2-0x0000000002680000-0x0000000002690000-memory.dmp

Filesize
64KB

Download
memory/908-8-0x0000000002750000-0x0000000004750000-memory.dmp

Filesize
32.0MB

Download
memory/908-9-0x0000000074ED0000-0x0000000075680000-memory.dmp

Filesize
7.7MB

Download
memory/4444-5-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4444-11-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4444-12-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4444-13-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4444-14-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download