lucastealer | eedeb7539b2f680304e81c08f27372bc5459b8e406872f8ea939065e466f0774

Resubmissions

01-12-2022 16:35

221201-t345xagb67 10

23-11-2022 19:33

221123-x9kavshd23 10

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2022 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe
Size

17.6MB
MD5

8c2a390aa7833720b374a720a6d06e4d
SHA1

188ec1a33bfd028333bcc3f6e96d2dbbdf01367f
SHA256

eedeb7539b2f680304e81c08f27372bc5459b8e406872f8ea939065e466f0774
SHA512

ac9bac95c37944ef7bb053126d5e5ba67c74562434b7bd4cb6f4c54e1d1cef8204990d670920f48af1cf26fb59ac422c0ccfe0075940cfe9c45e995897b86a07
SSDEEP

98304:BMSVESq5M3ClAD3sXHLQTyaQRO+YwWcRImg0cHQwb4CsB/wpDm7qCOPXwRalZLCt:2SSSP7sNavN7mg0mlb3DDdDP0

Score

10^/10

lucastealer stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot5740238611:AAESHdmffXlJNV7SD6-YjfXQmsg5jsSWb3Y

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer
Executes dropped EXE 1 IoCs

Processes:

UIServices.exe

pid process

1516 UIServices.exe
Loads dropped DLL 1 IoCs

Processes:

UIServices.exe

pid process

1516 UIServices.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1572 1516 WerFault.exe UIServices.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

UIServices.exe

pid process

1516 UIServices.exe
1516 UIServices.exe

pid	process
1516	UIServices.exe

pid	process
1516	UIServices.exe

pid	pid_target	process	target process
1572	1516	WerFault.exe	UIServices.exe

pid	process
1516	UIServices.exe
1516	UIServices.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.execmd.exe

description	pid	process	target process
PID 4804 wrote to memory of 2984	4804	SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe	cmd.exe
PID 4804 wrote to memory of 2984	4804	SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe	cmd.exe
PID 4804 wrote to memory of 2984	4804	SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe	cmd.exe
PID 2984 wrote to memory of 1516	2984	cmd.exe	UIServices.exe
PID 2984 wrote to memory of 1516	2984	cmd.exe	UIServices.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Heuristic.HEUR.AGEN.1253469.14711.357.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Users\Admin\AppData\Local\Temp\UIServices.exe
    C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:1516
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1516 -s 964
      4⤵
      Program crash
      PID:1572

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 1516 -ip 1516
1⤵
PID:4796

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UIServices.exe

Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
C:\Users\Admin\AppData\Local\Temp\UIServices.exe

Filesize
5.3MB

MD5
9edef0f9db07974c3ce9cba957327e78

SHA1
474f53d12af223f4c3da84f5832668fbb6611311

SHA256
90056c97ab02271509b04c192ae375ed775b5c2e642e4b85bec8d27742036e72

SHA512
e15a46dc659bf6ea591a69a7c40b0bd30626d5c533d21e48c3f4306f66a69ba822238461ad539b8d00bd9dd4c294ae43c1c54a1f2455eee2ade1670f93fcae09

Download Submit
C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
memory/1516-133-0x0000000000000000-mapping.dmp

Download
memory/2984-132-0x0000000000000000-mapping.dmp

Download