Analysis
- max time kernel
180s - max time network
196s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
26/11/2022, 19:09
General
- Target 12b10654f5c1372ce656c951448a75f72d25c28cda867c7fa1daf4d81760759b.exe
- Size 2.4MB
- Sample221126-xtvrnagd87
- SHA256 12b10654f5c1372ce656c951448a75f72d25c28cda867c7fa1daf4d81760759b
Score
10/10
Malware Config
Signatures
- Luca Stealer
Info stealer written in Rust first seen in July 2022.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\12b10654f5c1372ce656c951448a75f72d25c28cda867c7fa1daf4d81760759b.exe"C:\Users\Admin\AppData\Local\Temp\12b10654f5c1372ce656c951448a75f72d25c28cda867c7fa1daf4d81760759b.exe"1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1156-132-0x00007FF61BA10000-0x00007FF61BF97000-memory.dmp
memory/1156-133-0x00007FF61BA10000-0x00007FF61BF97000-memory.dmp