lucastealer | 7946f262e17efca2bfcd10e6919b6c03cd4164895cdc40c44ce7827cc63f5e35

Resubmissions

06/01/2023, 10:26

230106-mgngpsfg2910

01/12/2022, 16:35

221201-t32psagb5910

25/11/2022, 01:29

221125-bv9fjsfd2w8

Analysis

max time kernel
30s
max time network
30s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3c1ed24caa50ce23e852d3cc618e6ace.exe
Size 17.6MB
Sample230106-mgngpsfg29
SHA256 7946f262e17efca2bfcd10e6919b6c03cd4164895cdc40c44ce7827cc63f5e35
MD5 3c1ed24caa50ce23e852d3cc618e6ace
SHA1 a387decc624a3e86b9b3db1cf1ed14063a34599b
SHA512 f05e7c3088f3a82776fec0c933e080aacd885f7b86e8018f1d1873993ebca9a51f56033b68c381b41f196e6c03e9170ddcb3c245c690144e1aa9d085a4d5fd90
SSDEEP 98304:DMSVESq5LvCeXv0kFBoO3JnBdes+sWwRImg0cH2nP4o9p/wpDm7qCOPXwRalZLCt:ASSSMMkXnBb2mg0mwPBKDdDP0
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

lucastealer stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot5740238611:AAESHdmffXlJNV7SD6-YjfXQmsg5jsSWb3Y

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Executes dropped EXE 1 IoCs

pid	Process
3892	UIServices.exe

Loads dropped DLL 1 IoCs

pid	Process
3892	UIServices.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2580	4488	3c1ed24caa50ce23e852d3cc618e6ace.exe	88
PID 4488 wrote to memory of 2580	4488	3c1ed24caa50ce23e852d3cc618e6ace.exe	88
PID 4488 wrote to memory of 2580	4488	3c1ed24caa50ce23e852d3cc618e6ace.exe	88
PID 2580 wrote to memory of 3892	2580	cmd.exe	90
PID 2580 wrote to memory of 3892	2580	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\3c1ed24caa50ce23e852d3cc618e6ace.exe
"C:\Users\Admin\AppData\Local\Temp\3c1ed24caa50ce23e852d3cc618e6ace.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\UIServices.exe
    C:\Users\Admin\AppData\Local\Temp\UIServices.exe Start UIServices.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2664

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

UIServices.exe

Path C:\Users\Admin\AppData\Local\Temp\UIServices.exe
Size 5.3MB
SHA256 b81a331e58ff60255818c7596d4f724eed01b445bf41dfd389abece875a84b00
MD5 24d23afd8dbc9d8a6c062cea28fad926
SHA1 203b3b29a85a0f8170d42b9f8ce766953aed5d9c
SHA512 8dc659fd1ee3ec2aa698cdcf8f30ba2cca91688e04e6ae3fd8606d3a2c6d4a6166a066d3d889c269b4ede2bb626929c263930681c5a6677a1c9354e66106ad4c
SSDEEP 49152:TskReHKX32vc2uZSxrAElBoHr/bTS5dJIyYb/54aVSQ0ligqU1DUpsFH9Y/+oRSg:QCeXv0kFBoO3JnBdes+
MD5 SHA1 SHA512 SSDEEP

Submit Download

UIServices.exe

Path C:\Users\Admin\AppData\Local\Temp\UIServices.exe
Size 5.3MB
SHA256 b81a331e58ff60255818c7596d4f724eed01b445bf41dfd389abece875a84b00
MD5 24d23afd8dbc9d8a6c062cea28fad926
SHA1 203b3b29a85a0f8170d42b9f8ce766953aed5d9c
SHA512 8dc659fd1ee3ec2aa698cdcf8f30ba2cca91688e04e6ae3fd8606d3a2c6d4a6166a066d3d889c269b4ede2bb626929c263930681c5a6677a1c9354e66106ad4c
SSDEEP 49152:TskReHKX32vc2uZSxrAElBoHr/bTS5dJIyYb/54aVSQ0ligqU1DUpsFH9Y/+oRSg:QCeXv0kFBoO3JnBdes+
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\VCRUNTIME140.dll
Size 99KB
SHA256 7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f
MD5 7a2b8cfcd543f6e4ebca43162b67d610
SHA1 c1c45a326249bf0ccd2be2fbd412f1a62fb67024
SHA512 e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8
SSDEEP 1536:sC6b39cL/iRDhXq4GZLAy10i5XNC83tTPw98APXbxecbSQ25I4I/Cq:sVPphXq30yvXL5APbxecbSDu
MD5 SHA1 SHA512 SSDEEP

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
Size 99KB
SHA256 7d7ca28235fba5603a7f40514a552ac7efaa67a5d5792bb06273916aa8565c5f
MD5 7a2b8cfcd543f6e4ebca43162b67d610
SHA1 c1c45a326249bf0ccd2be2fbd412f1a62fb67024
SHA512 e38304fb9c5af855c1134f542adf72cde159fab64385533eafa5bb6e374f19b5a29c0cb5516fc5da5c0b5ac47c2f6420792e0ac8ddff11e749832a7b7f3eb5c8
SSDEEP 1536:sC6b39cL/iRDhXq4GZLAy10i5XNC83tTPw98APXbxecbSQ25I4I/Cq:sVPphXq30yvXL5APbxecbSDu
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads