Analysis
-
max time kernel
63s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
03-11-2022 14:52
General
-
Target
file.exe
-
Size
7.9MB
-
MD5
656132a78eeaabea8d8a81569d95282e
-
SHA1
6b684983a1d2de4dcbb56b1a6a8c887505954781
-
SHA256
174957651aa39490a2fa567bb4ca581f97597a7c289de76ebdf55701ffc891f8
-
SHA512
883634ac73e3f246cbe201312fe0869df838282d11203c38eddafbcde87175da94218fbeff1c031c566c7f6287785ed90b964e3a06a5889d3277965ee734e3ef
-
SSDEEP
196608:SCwCI0E5DGKXXzDIV0TYk45gmA8Ut6DFw306uSH1a:HuLDDIIYk45gMUkDFQ0hSVa
Score
10/10
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Luca Stealer payload 7 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.4MB
-
Filesize
2.0MB
-
Filesize
19.4MB
-
Filesize
19.4MB
-
Filesize
19.4MB
-
Filesize
19.4MB
-
Filesize
19.4MB
-
Filesize
19.4MB
-
Filesize
19.4MB
-
Filesize
2.0MB
-
Filesize
19.4MB