lumma | deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1

Analysis

max time kernel
195s
max time network
257s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
06-05-2024 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe
Size

472KB
MD5

46c72d686c836f3c97ce18b81b0d9864
SHA1

fdadd2e3cd971cd9fffb3de0f4a69ed0f77ae4a5
SHA256

deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1
SHA512

1ab8c8967155913c5dd0e2853d663bb096571062680de246fdda370947f7b6c3d2f44b85be97b821c630a4a42b3990d78601615737c3ced1418c9ccf18611208
SSDEEP

12288:ub3IzlSJCfjT1CDcLfSsYxolZ0B3HpCO00N4:ub3gMMT1iqSRxovg3HE+4

Score

10^/10

lumma zgrat rat stealer

Malware Config

Extracted

Family

lumma

https://miniaturefinerninewjs.shop/api

https://acceptabledcooeprs.shop/api

https://obsceneclassyjuwks.shop/api

https://zippyfinickysofwps.shop/api

https://plaintediousidowsko.shop/api

https://sweetsquarediaslw.shop/api

https://holicisticscrarws.shop/api

https://boredimperissvieos.shop/api

Signatures

Detect ZGRat V1 1 IoCs

resource	yara_rule
behavioral2/memory/2912-1-0x0000000000C00000-0x0000000000C7A000-memory.dmp	family_zgrat_v1

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73
PID 2912 wrote to memory of 2640	2912	deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe	73

C:\Users\Admin\AppData\Local\Temp\deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe
"C:\Users\Admin\AppData\Local\Temp\deaf3e009a0a9df61e84c2befdb5db10599f47c03fbdefbbdce83aac3a969cd1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  PID:2640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-5-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2640-8-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2640-11-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2912-0-0x000000007393E000-0x000000007393F000-memory.dmp

Filesize
4KB

Download
memory/2912-1-0x0000000000C00000-0x0000000000C7A000-memory.dmp

Filesize
488KB

Download
memory/2912-2-0x0000000073930000-0x000000007401E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-10-0x0000000073930000-0x000000007401E000-memory.dmp

Filesize
6.9MB

Download
memory/2912-12-0x0000000073930000-0x000000007401E000-memory.dmp

Filesize
6.9MB

Download