lucastealer | d363a849b1c4a3644b9dcfb3d03f96eb8bf3f6b05a8286f0911396c2b4642432

General

Target

018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe
Size

4.2MB
MD5

7bf21e9170fda8ffa3c22c892ecef29a
SHA1

ffbc2327df43ff7868ff2eeeeebbdb721bd522d1
SHA256

018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691
SHA512

763db449afe12f277952a3fc4dbcb18bae0bc34ad64f6155663be7553f3428d5b04b268b2ed1985b7ac7e15d80ee3646e783ada29f451801ac854674efd09396
SSDEEP

98304:Jm3Nfl9RXKKcB6fu4R1I/1C6KxLKwqcOIb6Csebp82yY837nB:Y3NflLXVcB6fu4R1uCFxKOPba2ylrB

Score

10^/10

lucastealer spyware stealer

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/files/0x0009000000022f51-137.dat	family_lucastealer
behavioral2/files/0x0009000000022f51-136.dat	family_lucastealer

Executes dropped EXE 2 IoCs

Processes:

Stealer.sfx.exeStealer.exe

pid	Process
2952	Stealer.sfx.exe
3280	Stealer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Stealer.sfx.exe018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Stealer.sfx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
19	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

Stealer.exe

pid	Process
3280	Stealer.exe
3280	Stealer.exe
3280	Stealer.exe
3280	Stealer.exe
3280	Stealer.exe
3280	Stealer.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exeStealer.sfx.exe

description	pid	Process	procid_target
PID 3496 wrote to memory of 2952	3496	018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe	80
PID 3496 wrote to memory of 2952	3496	018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe	80
PID 3496 wrote to memory of 2952	3496	018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe	80
PID 2952 wrote to memory of 3280	2952	Stealer.sfx.exe	82
PID 2952 wrote to memory of 3280	2952	Stealer.sfx.exe	82

C:\Users\Admin\AppData\Local\Temp\018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe
"C:\Users\Admin\AppData\Local\Temp\018f1b987d7d79a024055b9ad168a866856a4b1d5c9f14809375cade8c9fc691.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\Driver\Stealer.sfx.exe
  "C:\Users\Admin\AppData\Local\Temp\Driver\Stealer.sfx.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\File\Stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\File\Stealer.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Driver\Stealer.sfx.exe

Filesize
4.1MB

MD5
bb93f1a03d3d32add7d73c44c289f8d7

SHA1
627ee222a1faf0be481ae6c1217d99d492868c89

SHA256
7f56c8d8f721fcf8875459d4a7282b0607c97ae00458c76c1b0ee6766812eeae

SHA512
7bee165bd325b08e49ecdfd7dc1fcd8adc33ca5058874dfb833ad7c40196048d026f8a9694b7f19c3e3007f224396d9e8c34b27c08dc72c5d42aa2b4cd69e2c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Driver\Stealer.sfx.exe

Filesize
4.1MB

MD5
bb93f1a03d3d32add7d73c44c289f8d7

SHA1
627ee222a1faf0be481ae6c1217d99d492868c89

SHA256
7f56c8d8f721fcf8875459d4a7282b0607c97ae00458c76c1b0ee6766812eeae

SHA512
7bee165bd325b08e49ecdfd7dc1fcd8adc33ca5058874dfb833ad7c40196048d026f8a9694b7f19c3e3007f224396d9e8c34b27c08dc72c5d42aa2b4cd69e2c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\File\Stealer.exe

Filesize
4.2MB

MD5
4d5bac8fab6ecb15ab34d42adbd0cd15

SHA1
a7f50d486fe065abe0ce50d5dc51d9930d238f2d

SHA256
bf5d5d1e5180d8dacb9cd543015a0304248c19d1b017ce00244aa83d0dcfa352

SHA512
4cb9af4abd9948325d1622b76f2fb16c7366f8a96dcd4760d28ef67c53919407de14e12df5e098d4fe467c4bb85cebfb1b5e845cf5a585e635cd11972ad989f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\File\Stealer.exe

Filesize
4.2MB

MD5
4d5bac8fab6ecb15ab34d42adbd0cd15

SHA1
a7f50d486fe065abe0ce50d5dc51d9930d238f2d

SHA256
bf5d5d1e5180d8dacb9cd543015a0304248c19d1b017ce00244aa83d0dcfa352

SHA512
4cb9af4abd9948325d1622b76f2fb16c7366f8a96dcd4760d28ef67c53919407de14e12df5e098d4fe467c4bb85cebfb1b5e845cf5a585e635cd11972ad989f5

Download Submit
memory/2952-132-0x0000000000000000-mapping.dmp

Download
memory/3280-135-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads