lumma | 7d11115576e864498bcd15f08c2c390b23613b4391c959a82694eafa84650ed2

Analysis

max time kernel
95s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ChineseTriad/Installer.exe
Size

472KB
MD5

fc032e9bac8d0a7dc77f1ce1d01fe91f
SHA1

614469892aa6b7e09e5e107fb6b791a85701dffc
SHA256

01f4fb08ec4c575c2148e9c86a6c7e850a33f48cdd632e8b75fed224dd01ae89
SHA512

de1f1457122b889de6bc10576d5ac4b0f577d9daebf30dd36c693dbb75c11ab27d6e2c4328384caa5aa1ff63b0195bd4257c4f8194f21017e69707f40f61f9b0
SSDEEP

12288:sb3B1kiKP156uhoDDoqi/Rh3O9hRLkCr3rCbAnFb:sb33kiKt5+oqwh3O9htkI7Jl

Score

10^/10

lumma zgrat rat stealer

Malware Config

Extracted

Family

lumma

https://auctiongutollyjkui.shop/api

https://acceptabledcooeprs.shop/api

https://obsceneclassyjuwks.shop/api

https://zippyfinickysofwps.shop/api

https://miniaturefinerninewjs.shop/api

https://plaintediousidowsko.shop/api

https://sweetsquarediaslw.shop/api

https://holicisticscrarws.shop/api

https://boredimperissvieos.shop/api

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral1/memory/4584-1-0x00000000004A0000-0x000000000051A000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 3508	4584	Installer.exe	84

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84
PID 4584 wrote to memory of 3508	4584	Installer.exe	84

C:\Users\Admin\AppData\Local\Temp\ChineseTriad\Installer.exe
"C:\Users\Admin\AppData\Local\Temp\ChineseTriad\Installer.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:3508

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3508-5-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3508-8-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3508-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/4584-0-0x0000000074B2E000-0x0000000074B2F000-memory.dmp

Filesize
4KB

Download
memory/4584-1-0x00000000004A0000-0x000000000051A000-memory.dmp

Filesize
488KB

Download
memory/4584-2-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-10-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download
memory/4584-12-0x0000000074B20000-0x00000000752D0000-memory.dmp

Filesize
7.7MB

Download