lucastealer | 7946f262e17efca2bfcd10e6919b6c03cd4164895cdc40c44ce7827cc63f5e35

Resubmissions

06-01-2023 10:26

230106-mgngpsfg29 10

01-12-2022 16:35

221201-t32psagb59 10

25-11-2022 01:29

221125-bv9fjsfd2w 8

Analysis

max time kernel
51s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-01-2023 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c1ed24caa50ce23e852d3cc618e6ace.exe
Size

17.6MB
MD5

3c1ed24caa50ce23e852d3cc618e6ace
SHA1

a387decc624a3e86b9b3db1cf1ed14063a34599b
SHA256

7946f262e17efca2bfcd10e6919b6c03cd4164895cdc40c44ce7827cc63f5e35
SHA512

f05e7c3088f3a82776fec0c933e080aacd885f7b86e8018f1d1873993ebca9a51f56033b68c381b41f196e6c03e9170ddcb3c245c690144e1aa9d085a4d5fd90
SSDEEP

98304:DMSVESq5LvCeXv0kFBoO3JnBdes+sWwRImg0cH2nP4o9p/wpDm7qCOPXwRalZLCt:ASSSMMkXnBb2mg0mwPBKDdDP0

Score

10^/10

lucastealer stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot5740238611:AAESHdmffXlJNV7SD6-YjfXQmsg5jsSWb3Y

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Executes dropped EXE 1 IoCs

Processes:

UIServices.exe

pid	Process
468	UIServices.exe

Loads dropped DLL 3 IoCs

Processes:

cmd.exeUIServices.exe

pid	Process
2012	cmd.exe
2012	cmd.exe
468	UIServices.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3c1ed24caa50ce23e852d3cc618e6ace.execmd.exe

description	pid	Process	procid_target
PID 2000 wrote to memory of 2012	2000	3c1ed24caa50ce23e852d3cc618e6ace.exe	28
PID 2000 wrote to memory of 2012	2000	3c1ed24caa50ce23e852d3cc618e6ace.exe	28
PID 2000 wrote to memory of 2012	2000	3c1ed24caa50ce23e852d3cc618e6ace.exe	28
PID 2000 wrote to memory of 2012	2000	3c1ed24caa50ce23e852d3cc618e6ace.exe	28
PID 2012 wrote to memory of 468	2012	cmd.exe	30
PID 2012 wrote to memory of 468	2012	cmd.exe	30
PID 2012 wrote to memory of 468	2012	cmd.exe	30
PID 2012 wrote to memory of 468	2012	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\3c1ed24caa50ce23e852d3cc618e6ace.exe
"C:\Users\Admin\AppData\Local\Temp\3c1ed24caa50ce23e852d3cc618e6ace.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\UIServices.exe
    C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\UIServices.exe

Filesize
5.3MB

MD5
24d23afd8dbc9d8a6c062cea28fad926

SHA1
203b3b29a85a0f8170d42b9f8ce766953aed5d9c

SHA256
b81a331e58ff60255818c7596d4f724eed01b445bf41dfd389abece875a84b00

SHA512
8dc659fd1ee3ec2aa698cdcf8f30ba2cca91688e04e6ae3fd8606d3a2c6d4a6166a066d3d889c269b4ede2bb626929c263930681c5a6677a1c9354e66106ad4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\UIServices.exe

Filesize
5.3MB

MD5
24d23afd8dbc9d8a6c062cea28fad926

SHA1
203b3b29a85a0f8170d42b9f8ce766953aed5d9c

SHA256
b81a331e58ff60255818c7596d4f724eed01b445bf41dfd389abece875a84b00

SHA512
8dc659fd1ee3ec2aa698cdcf8f30ba2cca91688e04e6ae3fd8606d3a2c6d4a6166a066d3d889c269b4ede2bb626929c263930681c5a6677a1c9354e66106ad4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
\Users\Admin\AppData\Local\Temp\UIServices.exe

Filesize
5.3MB

MD5
24d23afd8dbc9d8a6c062cea28fad926

SHA1
203b3b29a85a0f8170d42b9f8ce766953aed5d9c

SHA256
b81a331e58ff60255818c7596d4f724eed01b445bf41dfd389abece875a84b00

SHA512
8dc659fd1ee3ec2aa698cdcf8f30ba2cca91688e04e6ae3fd8606d3a2c6d4a6166a066d3d889c269b4ede2bb626929c263930681c5a6677a1c9354e66106ad4c

Download Submit
\Users\Admin\AppData\Local\Temp\UIServices.exe

Filesize
5.3MB

MD5
24d23afd8dbc9d8a6c062cea28fad926

SHA1
203b3b29a85a0f8170d42b9f8ce766953aed5d9c

SHA256
b81a331e58ff60255818c7596d4f724eed01b445bf41dfd389abece875a84b00

SHA512
8dc659fd1ee3ec2aa698cdcf8f30ba2cca91688e04e6ae3fd8606d3a2c6d4a6166a066d3d889c269b4ede2bb626929c263930681c5a6677a1c9354e66106ad4c

Download Submit
\Users\Admin\AppData\Local\Temp\vcruntime140.dll

Filesize
99KB

MD5
7a2b8cfcd543f6e4ebca43162b67d610

SHA1
c1c45a326249bf0ccd2be2fbd412f1a62fb67024

SHA256
7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f

SHA512
e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8

Download Submit
memory/468-59-0x0000000000000000-mapping.dmp

Download
memory/2000-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000000000-mapping.dmp

Download