lucastealer | 174957651aa39490a2fa567bb4ca581f97597a7c289de76ebdf55701ffc891f8

Analysis

max time kernel
43s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03-11-2022 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.9MB
MD5

656132a78eeaabea8d8a81569d95282e
SHA1

6b684983a1d2de4dcbb56b1a6a8c887505954781
SHA256

174957651aa39490a2fa567bb4ca581f97597a7c289de76ebdf55701ffc891f8
SHA512

883634ac73e3f246cbe201312fe0869df838282d11203c38eddafbcde87175da94218fbeff1c031c566c7f6287785ed90b964e3a06a5889d3277965ee734e3ef
SSDEEP

196608:SCwCI0E5DGKXXzDIV0TYk45gmA8Ut6DFw306uSH1a:HuLDDIIYk45gMUkDFQ0hSVa

Score

10^/10

lucastealer bootkit evasion persistence stealer trojan

Malware Config

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1708-55-0x000000013F0D0000-0x0000000140436000-memory.dmp	family_lucastealer
behavioral1/memory/1708-57-0x000000013F0D0000-0x0000000140436000-memory.dmp	family_lucastealer
behavioral1/memory/1708-59-0x000000013F0D0000-0x0000000140436000-memory.dmp	family_lucastealer
behavioral1/memory/1708-60-0x000000013F0D0000-0x0000000140436000-memory.dmp	family_lucastealer
behavioral1/memory/1708-61-0x000000013F0D0000-0x0000000140436000-memory.dmp	family_lucastealer
behavioral1/memory/1708-62-0x000000013F0D0000-0x0000000140436000-memory.dmp	family_lucastealer
behavioral1/memory/1708-63-0x000000013F0D0000-0x0000000140436000-memory.dmp	family_lucastealer

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

file.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

file.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

file.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

file.exe

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	file.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

file.exe

pid	Process
1708	file.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1708-54-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-56-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-55-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-58-0x0000000076DD0000-0x0000000076F79000-memory.dmp

Filesize
1.7MB

Download
memory/1708-57-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-59-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-60-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-61-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-62-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-63-0x000000013F0D0000-0x0000000140436000-memory.dmp

Filesize
19.4MB

Download
memory/1708-64-0x0000000076DD0000-0x0000000076F79000-memory.dmp

Filesize
1.7MB

Download