Lumma Stealer infection with Sectop RAT (ArechClient2)

SOC Prime Team

Lumma Stealer infection with Sectop RAT (ArechClient2)

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

The report outlines a two-stage infection chain in which Lumma Stealer is initially delivered through a password-protected 7-Zip archive, followed by the loading of a Sectop RAT (ArechClient2) DLL at a later stage. The first payload arrives as a bloated Windows executable padded with null bytes, a tactic likely intended to evade detection and complicate analysis. The malware is distributed through compromised download pages that mimic legitimate services, increasing the likelihood of user execution. Network telemetry linked the activity to multiple malicious domains and a known IP address used for command-and-control communication.

Investigation

The analyst obtained the malicious archive, extracted the oversized executable, and examined its reduced form after deflation. Sandbox analysis revealed several command-and-control domains associated with Lumma Stealer, along with a separate DLL component that loaded Sectop RAT through rundll32. Network captures also showed HTTP traffic to a malicious IP address over ports 9000 and 443, with the exchanged data appearing to be encoded.

Mitigation

Organizations should use content inspection tools capable of identifying inflated executables and password-protected archives. Known malicious domains and IP addresses tied to the campaign should be blocked at the network layer. Defenders should also monitor for suspicious rundll32 activity involving unexpected DLLs and track outbound connections to the identified command-and-control infrastructure. Strong download controls and restrictions on file-sharing sites hosting cracked or untrusted software can further reduce exposure.

Response

Security teams should alert when password-protected 7-Zip archives are downloaded from suspicious URLs. Additional detections should focus on execution of unusually large padded executables and rundll32 launching DLLs from temporary or user-accessible directories. Network telemetry should be correlated against the listed domains and IP address, and any affected systems should be quarantined immediately for investigation and remediation.

"graph TB %% Class definitions classDef technique fill:#ffcc99 classDef tool fill:#c2f0c2 classDef malware fill:#ffb3b3 classDef operator fill:#ff9900 %% Nodes technique_content_injection["Technique – T1659 Content Injection Compromise websites to inject malicious resources like download links."] class technique_content_injection technique tool_lumma_stealer["Tool – Name: Lumma Stealer Function: Harvests stored passwords and credential manager entries."] class tool_lumma_stealer tool technique_obfuscation_files["Technique – T1027 Obfuscated Files or Information Encode or encrypt payloads to hide malicious content."] class technique_obfuscation_files technique technique_compression["Technique – T1027.015 Archive via Utility Use passwordu2011protected 7u2011zip archive to conceal payload."] class technique_compression technique technique_credential_store["Technique – T1555 Credentials from Password Stores Extract credentials saved in browsers, apps, or OS stores."] class technique_credential_store technique technique_credential_manager["Technique – T1555.004 Windows Credential Manager Dump credentials stored in Windows Credential Manager."] class technique_credential_manager technique technique_unsecured_file["Technique – T1552.001 Unsecured Credentials in Files Read credential data left in plainu2011text files."] class technique_unsecured_file technique technique_rundll32_proxy["Technique – T1218.011 Rundll32 Execute DLL code via rundll32.exe with LoadForm entrypoint."] class technique_rundll32_proxy technique technique_appcert_dll["Technique – T1546.009 AppCert DLL Trigger DLL loading through Application Certification mechanism."] class technique_appcert_dll technique malware_netgui_dll["Malware – Name: NetGui.dll Role: Dropped DLL loaded by rundll32."] class malware_netgui_dll malware technique_web_protocol["Technique – T1071.001 Web Protocols Use HTTP/HTTPS for command and control traffic."] class technique_web_protocol technique technique_bidirectional["Technique – T1102.002 Bidirectional Web Service Exchange commands and data over a web service channel."] class technique_bidirectional technique technique_encrypted_channel["Technique – T1573 Encrypted Channel Encrypt C2 traffic to evade detection."] class technique_encrypted_channel technique technique_protocol_tunneling["Technique – T1572 Protocol Tunneling Encapsulate malicious traffic inside legitimate protocols."] class technique_protocol_tunneling technique technique_data_obfuscation["Technique – T1001 Data Obfuscation Obfuscate payload data to hide its purpose."] class technique_data_obfuscation technique %% Connections technique_content_injection –>|uses| tool_lumma_stealer tool_lumma_stealer –>|delivers| technique_obfuscation_files technique_obfuscation_files –>|includes| technique_compression technique_compression –>|leads to| technique_credential_store technique_credential_store –>|also uses| technique_credential_manager technique_credential_manager –>|and| technique_unsecured_file technique_unsecured_file –>|enables| technique_rundll32_proxy technique_rundll32_proxy –>|loads| malware_netgui_dll malware_netgui_dll –>|triggers| technique_appcert_dll technique_appcert_dll –>|establishes| technique_web_protocol technique_web_protocol –>|uses| technique_bidirectional technique_bidirectional –>|protected by| technique_encrypted_channel technique_encrypted_channel –>|further hidden via| technique_protocol_tunneling technique_protocol_tunneling –>|uses| technique_data_obfuscation "

Attack Flow

# Simulate Lumma Stealer drop and DLL injection
$archiveName = "adobe_premiere_pro_(2026)_full_v26.0.2_español_[mega].7z"
$downloadDir = "$env:USERPROFILEDownloads"
$tempDllPath = "$env:LOCALAPPDATATemp16XBPQ29ZBG94TYNOA.dll"

# Step 1: Create a dummy archive file (simulating the download)
New-Item -Path (Join-Path $downloadDir $archiveName) -ItemType File -Force | Out-Null

# Step 2: Simulate extraction – create the malicious DLL in the Temp folder
New-Item -Path $tempDllPath -ItemType File -Force | Out-Null

Write-Host "Simulation complete: $archiveName created and DLL dropped to Temp."

Cleanup Commands:

# Remove simulated artifacts
Remove-Item -Path "$env:USERPROFILEDownloadsadobe_premiere_pro_(2026)_full_v26.0.2_español_[mega].7z" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "$env:LOCALAPPDATATemp16XBPQ29ZBG94TYNOA.dll" -Force -ErrorAction SilentlyContinue
Write-Host "Cleanup complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free