lumma | 0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe
Size

3.3MB
MD5

031f0b4bce3ba22d9e46cbeec1b73360
SHA1

4d6899fff97cff74a188c772aacfee3ea73731e6
SHA256

0a115cf0821cd01199c474d8b3a5211b06ee8adb894309d8110dad577e6e9117
SHA512

f1bd60f3989d56f7775956347f03e8b69f36f4424ecf6bdbb818c9cc4ac4f4ac16e32a21ff3a096acc1ea69f9b98126d42b582e9556ecec2503042b12217279f
SSDEEP

49152:B6Ee3j3piO4kHpKW4l4Gkdnx6KUnUa7ufJcbHpmqn8W42LQEKJWAOfraP:B6x3vZ4mGkz6KUr7ufJFiy60WAOfraP

Score

10^/10

lumma zgrat rat stealer

Malware Config

Extracted

Family

lumma

https://sloganprogrevidefkso.shop/api

https://sofaprivateawarderysj.shop/api

https://lineagelasserytailsd.shop/api

https://tendencyportionjsuk.shop/api

https://headraisepresidensu.shop/api

https://appetitesallooonsj.shop/api

https://minorittyeffeoos.shop/api

https://prideconstituiiosjk.shop/api

https://smallelementyjdui.shop/api

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/232-1-0x0000000000730000-0x0000000000A76000-memory.dmp family_zgrat_v1
Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource yara_rule

behavioral2/memory/232-1-0x0000000000730000-0x0000000000A76000-memory.dmp net_reactor
Loads dropped DLL 1 IoCs

Processes:

031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe

pid process

232 031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe

description pid process target process

PID 232 set thread context of 4524 232 031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe MsBuild.exe

resource	yara_rule
behavioral2/memory/232-1-0x0000000000730000-0x0000000000A76000-memory.dmp	family_zgrat_v1

resource	yara_rule
behavioral2/memory/232-1-0x0000000000730000-0x0000000000A76000-memory.dmp	net_reactor

pid	process
232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe

description	pid	process	target process
PID 232 set thread context of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe

description	pid	process	target process
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe
PID 232 wrote to memory of 4524	232	031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe	MsBuild.exe

C:\Users\Admin\AppData\Local\Temp\031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\031f0b4bce3ba22d9e46cbeec1b73360_NeikiAnalytics.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
2⤵
PID:4524

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Protect544cd51a.dll
Filesize
742KB

MD5
544cd51a596619b78e9b54b70088307d

SHA1
4769ddd2dbc1dc44b758964ed0bd231b85880b65

SHA256
dfce2d4d06de6452998b3c5b2dc33eaa6db2bd37810d04e3d02dc931887cfddd

SHA512
f56d8b81022bb132d40aa78596da39b5c212d13b84b5c7d2c576bbf403924f1d22e750de3b09d1be30aea359f1b72c5043b19685fc9bf06d8040bfee16b17719

Download Submit
memory/232-12-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-3-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-14-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-15-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-1-0x0000000000730000-0x0000000000A76000-memory.dmp

Filesize
3.3MB

Download
memory/232-10-0x0000000005A40000-0x0000000005A50000-memory.dmp

Filesize
64KB

Download
memory/232-11-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-0-0x0000000074E4E000-0x0000000074E4F000-memory.dmp

Filesize
4KB

Download
memory/232-13-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-2-0x0000000005300000-0x000000000539C000-memory.dmp

Filesize
624KB

Download
memory/232-4-0x00000000054A0000-0x0000000005632000-memory.dmp

Filesize
1.6MB

Download
memory/232-16-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-17-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-19-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/232-23-0x0000000074E40000-0x00000000755F0000-memory.dmp

Filesize
7.7MB

Download
memory/4524-24-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4524-22-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download
memory/4524-18-0x0000000000400000-0x0000000000456000-memory.dmp

Filesize
344KB

Download