Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
07/04/2024, 05:56
General
- Target Software_1.30.1.exe
- Size 4.7MB
- Sample240407-gm124afa28
- SHA256 2bd6df3a98337e2b75e9fdb9815538c84eff19ea760374a47db979b828918fc2
Malware Config
Extracted
-
lumma
-
https://appliedgrandyjuiw.shop/api
-
https://birdpenallitysydw.shop/api
-
https://cinemaclinicttanwk.shop/api
-
https://disagreemenywyws.shop/api
-
https://speedparticipatewo.shop/api
-
https://fixturewordbakewos.shop/api
-
https://colorprioritytubbew.shop/api
-
https://abuselinenaidwjuew.shop/api
-
https://methodgreenglassdatw.shop/api
Signatures
- Detect ZGRat V1 34 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- ZGRat
ZGRat is remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Software_1.30.1.exe"C:\Users\Admin\AppData\Local\Temp\Software_1.30.1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1544-0-0x00000000009D0000-0x0000000000A26000-memory.dmp
memory/1544-1-0x0000000074E90000-0x0000000075640000-memory.dmp
memory/1544-2-0x0000000002CB0000-0x0000000002CC0000-memory.dmp
memory/1544-3-0x0000000006CB0000-0x0000000006EF2000-memory.dmp
memory/1544-4-0x00000000074A0000-0x0000000007A44000-memory.dmp
memory/1544-5-0x0000000006F90000-0x0000000007022000-memory.dmp
memory/1544-6-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-7-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-9-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-11-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-13-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-15-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-17-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-19-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-21-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-23-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-25-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-27-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-29-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-31-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-33-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-35-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-37-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-39-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-41-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-43-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-45-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-47-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-49-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-51-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-53-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-55-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-57-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-59-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-61-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-63-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-65-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-67-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-69-0x0000000006CB0000-0x0000000006EEC000-memory.dmp
memory/1544-2036-0x0000000074E90000-0x0000000075640000-memory.dmp
memory/1544-2662-0x0000000002CB0000-0x0000000002CC0000-memory.dmp
memory/1544-4888-0x00000000059C0000-0x00000000059C1000-memory.dmp
memory/1544-4889-0x0000000007130000-0x00000000071AE000-memory.dmp
memory/1544-4890-0x00000000071C0000-0x000000000720C000-memory.dmp
memory/1544-4892-0x0000000077891000-0x00000000779B1000-memory.dmp
memory/1544-4893-0x0000000007210000-0x0000000007264000-memory.dmp
memory/1544-4899-0x0000000074E90000-0x0000000075640000-memory.dmp
memory/4600-4898-0x0000000000400000-0x000000000044C000-memory.dmp
memory/4600-4901-0x0000000001320000-0x0000000001352000-memory.dmp
memory/4600-4900-0x0000000001320000-0x0000000001352000-memory.dmp
memory/4600-4903-0x0000000001320000-0x0000000001352000-memory.dmp
memory/4600-4902-0x0000000001320000-0x0000000001352000-memory.dmp
memory/4600-4904-0x0000000001320000-0x0000000001352000-memory.dmp