lucastealer | 871d31c0afc5cc10080d680ee474590b85d903c7f4ef0e2d1da30ce41b39ba4c

Analysis

max time kernel
26s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-02-2023 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Venom Cracked 2.7.0.0/Builder.exe
Size

3.5MB
MD5

15a33df64cba23643fa9e4585c7b036f
SHA1

8f0f7b11935d97738af92ea14bc568fe8aa81350
SHA256

30fa591984d03b20f66ae6392d96c69d5861dbf1813c5230204310a93aea5c78
SHA512

8eb5221844147882019dae094979b4e43f17cb256c9f689c64b337a4f83ef8325e9d9d9cb948bf5a88beda2b71a1688b87af5fe318240a394d15a6be2d2adfe8
SSDEEP

98304:2WBZRr5nJ9NnqrcTOMSAdnLOOY6cy+XFjbpkiZ3k:2WBZR9n5ulMSmnaOLmXpbpLi

Score

10^/10

lucastealer spyware stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot5798214226:AAEtDAC9RFjL7TuqpdnFECmBJAay7aTl2tc

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Executes dropped EXE 3 IoCs

Processes:

System.exeBuilder.exe

pid	Process
1496	System.exe
1320	Builder.exe
1244

Loads dropped DLL 3 IoCs

Processes:

Builder.exe

pid	Process
852	Builder.exe
852	Builder.exe
852	Builder.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
1676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

System.exe

pid	Process
1496	System.exe
1496	System.exe
1496	System.exe
1496	System.exe
1496	System.exe
1496	System.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

System.exe

description	pid	Process
Token: SeShutdownPrivilege	1496	System.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Builder.exeSystem.execmd.exe

description	pid	Process	procid_target
PID 852 wrote to memory of 1496	852	Builder.exe	28
PID 852 wrote to memory of 1496	852	Builder.exe	28
PID 852 wrote to memory of 1496	852	Builder.exe	28
PID 852 wrote to memory of 1320	852	Builder.exe	29
PID 852 wrote to memory of 1320	852	Builder.exe	29
PID 852 wrote to memory of 1320	852	Builder.exe	29
PID 1496 wrote to memory of 1088	1496	System.exe	31
PID 1496 wrote to memory of 1088	1496	System.exe	31
PID 1496 wrote to memory of 1088	1496	System.exe	31
PID 1088 wrote to memory of 1676	1088	cmd.exe	33
PID 1088 wrote to memory of 1676	1088	cmd.exe	33
PID 1088 wrote to memory of 1676	1088	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\Venom Cracked 2.7.0.0\Builder.exe
"C:\Users\Admin\AppData\Local\Temp\Venom Cracked 2.7.0.0\Builder.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe
  "C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe" /silent
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c "schtasks /Create /TR C:\Users\Admin\AppData\Roaming\svchost.exe /SC ONLOGON /TN RecordArchive /IT"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TR C:\Users\Admin\AppData\Roaming\svchost.exe /SC ONLOGON /TN RecordArchive /IT
      4⤵
      Creates scheduled task(s)
      PID:1676
- C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe
  "C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe" /silent
  2⤵
  - Executes dropped EXE
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe

Filesize
3.1MB

MD5
38791f0aa86973d6c674bc7ea7e08fea

SHA1
27e3999c2fc4e2b145ad5d4e0d17f38b7b032101

SHA256
e05e6fe9e454c132a68db6a76a4413250cbdb98b2b9a956353c90f60ac6fa422

SHA512
35fbf43c12f18d15291cf1dbc9d8439369d955f1c2e2f7874cce5a38a1918e03ae253af847de10e80376f0318ec89ede2bef054c652c2071d689af232089ea02

Download Submit
C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe

Filesize
3.1MB

MD5
38791f0aa86973d6c674bc7ea7e08fea

SHA1
27e3999c2fc4e2b145ad5d4e0d17f38b7b032101

SHA256
e05e6fe9e454c132a68db6a76a4413250cbdb98b2b9a956353c90f60ac6fa422

SHA512
35fbf43c12f18d15291cf1dbc9d8439369d955f1c2e2f7874cce5a38a1918e03ae253af847de10e80376f0318ec89ede2bef054c652c2071d689af232089ea02

Download Submit
C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe

Filesize
6.0MB

MD5
e1d93c10865bb4228c0d4d780fb5ac88

SHA1
233b4cb7cef41898eda51a869ff445c3db529ae4

SHA256
4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

SHA512
de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

Download Submit
C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe

Filesize
6.0MB

MD5
e1d93c10865bb4228c0d4d780fb5ac88

SHA1
233b4cb7cef41898eda51a869ff445c3db529ae4

SHA256
4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

SHA512
de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

Download Submit
\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe

Filesize
3.1MB

MD5
38791f0aa86973d6c674bc7ea7e08fea

SHA1
27e3999c2fc4e2b145ad5d4e0d17f38b7b032101

SHA256
e05e6fe9e454c132a68db6a76a4413250cbdb98b2b9a956353c90f60ac6fa422

SHA512
35fbf43c12f18d15291cf1dbc9d8439369d955f1c2e2f7874cce5a38a1918e03ae253af847de10e80376f0318ec89ede2bef054c652c2071d689af232089ea02

Download Submit
\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe

Filesize
3.1MB

MD5
38791f0aa86973d6c674bc7ea7e08fea

SHA1
27e3999c2fc4e2b145ad5d4e0d17f38b7b032101

SHA256
e05e6fe9e454c132a68db6a76a4413250cbdb98b2b9a956353c90f60ac6fa422

SHA512
35fbf43c12f18d15291cf1dbc9d8439369d955f1c2e2f7874cce5a38a1918e03ae253af847de10e80376f0318ec89ede2bef054c652c2071d689af232089ea02

Download Submit
\Users\Admin\AppData\Roaming\Local\Programs\System.exe

Filesize
6.0MB

MD5
e1d93c10865bb4228c0d4d780fb5ac88

SHA1
233b4cb7cef41898eda51a869ff445c3db529ae4

SHA256
4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

SHA512
de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

Download Submit
\Users\Admin\AppData\Roaming\Local\Programs\System.exe

Filesize
6.0MB

MD5
e1d93c10865bb4228c0d4d780fb5ac88

SHA1
233b4cb7cef41898eda51a869ff445c3db529ae4

SHA256
4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

SHA512
de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

Download Submit
memory/852-54-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

Filesize
8KB

Download
memory/1088-66-0x0000000000000000-mapping.dmp

Download
memory/1320-60-0x0000000000000000-mapping.dmp

Download
memory/1496-57-0x0000000000000000-mapping.dmp

Download
memory/1676-67-0x0000000000000000-mapping.dmp

Download