Analysis
- max time kernel
90s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
01/12/2022, 16:35
General
- Target c82fa54ea87c77df522b4f7acd0f864a.exe
- Size 2.4MB
- Sample221201-t36nqsbf2v
- SHA256 12b10654f5c1372ce656c951448a75f72d25c28cda867c7fa1daf4d81760759b
Score
10/10
Malware Config
Extracted
Family
-
lucastealer
C2
-
https://discord.com/api/webhooks/1039311547425640518/lMmTqbPugNDu_ZDCwjwcSOibAKdac1rSgQqQo7l7aXWncfJ-97uDFaBWLcbvbe0npp3B
Signatures
- Luca Stealer
Info stealer written in Rust first seen in July 2022.
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c82fa54ea87c77df522b4f7acd0f864a.exe"C:\Users\Admin\AppData\Local\Temp\c82fa54ea87c77df522b4f7acd0f864a.exe"1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4936 -s 15602⤵
- Program crash
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 4936 -ip 49361⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4936-132-0x00007FF70A6D0000-0x00007FF70AC57000-memory.dmp
memory/4936-133-0x00007FF70A6D0000-0x00007FF70AC57000-memory.dmp