lucastealer | 871d31c0afc5cc10080d680ee474590b85d903c7f4ef0e2d1da30ce41b39ba4c

Analysis

max time kernel
30s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2023 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Venom Cracked 2.7.0.0/Builder.exe
Size

3.5MB
MD5

15a33df64cba23643fa9e4585c7b036f
SHA1

8f0f7b11935d97738af92ea14bc568fe8aa81350
SHA256

30fa591984d03b20f66ae6392d96c69d5861dbf1813c5230204310a93aea5c78
SHA512

8eb5221844147882019dae094979b4e43f17cb256c9f689c64b337a4f83ef8325e9d9d9cb948bf5a88beda2b71a1688b87af5fe318240a394d15a6be2d2adfe8
SSDEEP

98304:2WBZRr5nJ9NnqrcTOMSAdnLOOY6cy+XFjbpkiZ3k:2WBZR9n5ulMSmnaOLmXpbpLi

Score

10^/10

lucastealer spyware stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot5798214226:AAEtDAC9RFjL7TuqpdnFECmBJAay7aTl2tc

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Builder.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Builder.exe

Executes dropped EXE 2 IoCs

Processes:

System.exeBuilder.exe

pid	Process
3508	System.exe
1652	Builder.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
26	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exe

pid	Process
268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

System.exe

pid	Process
3508	System.exe
3508	System.exe
3508	System.exe
3508	System.exe
3508	System.exe
3508	System.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

Builder.exeSystem.execmd.exe

description	pid	Process	procid_target
PID 3060 wrote to memory of 3508	3060	Builder.exe	80
PID 3060 wrote to memory of 3508	3060	Builder.exe	80
PID 3060 wrote to memory of 1652	3060	Builder.exe	81
PID 3060 wrote to memory of 1652	3060	Builder.exe	81
PID 3508 wrote to memory of 4880	3508	System.exe	87
PID 3508 wrote to memory of 4880	3508	System.exe	87
PID 4880 wrote to memory of 268	4880	cmd.exe	89
PID 4880 wrote to memory of 268	4880	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\Venom Cracked 2.7.0.0\Builder.exe
"C:\Users\Admin\AppData\Local\Temp\Venom Cracked 2.7.0.0\Builder.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe
  "C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe" /silent
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Windows\system32\cmd.exe
    "cmd.exe" /c "schtasks /Create /TR C:\Users\Admin\AppData\Roaming\svchost.exe /SC ONLOGON /TN RecordArchive /IT"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\system32\schtasks.exe
      schtasks /Create /TR C:\Users\Admin\AppData\Roaming\svchost.exe /SC ONLOGON /TN RecordArchive /IT
      4⤵
      Creates scheduled task(s)
      PID:268
- C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe
  "C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe" /silent
  2⤵
  - Executes dropped EXE
  PID:1652

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe

Filesize
3.1MB

MD5
38791f0aa86973d6c674bc7ea7e08fea

SHA1
27e3999c2fc4e2b145ad5d4e0d17f38b7b032101

SHA256
e05e6fe9e454c132a68db6a76a4413250cbdb98b2b9a956353c90f60ac6fa422

SHA512
35fbf43c12f18d15291cf1dbc9d8439369d955f1c2e2f7874cce5a38a1918e03ae253af847de10e80376f0318ec89ede2bef054c652c2071d689af232089ea02

Download Submit
C:\Users\Admin\AppData\Roaming\Local\Programs\Builder.exe

Filesize
3.1MB

MD5
38791f0aa86973d6c674bc7ea7e08fea

SHA1
27e3999c2fc4e2b145ad5d4e0d17f38b7b032101

SHA256
e05e6fe9e454c132a68db6a76a4413250cbdb98b2b9a956353c90f60ac6fa422

SHA512
35fbf43c12f18d15291cf1dbc9d8439369d955f1c2e2f7874cce5a38a1918e03ae253af847de10e80376f0318ec89ede2bef054c652c2071d689af232089ea02

Download Submit
C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe

Filesize
6.0MB

MD5
e1d93c10865bb4228c0d4d780fb5ac88

SHA1
233b4cb7cef41898eda51a869ff445c3db529ae4

SHA256
4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

SHA512
de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

Download Submit
C:\Users\Admin\AppData\Roaming\Local\Programs\System.exe

Filesize
6.0MB

MD5
e1d93c10865bb4228c0d4d780fb5ac88

SHA1
233b4cb7cef41898eda51a869ff445c3db529ae4

SHA256
4de0b946d9cf0122688c715d808ebc5cec6f16b1001ed70a0dc7de3745d0a65a

SHA512
de355a07ee2a54d24c8b78a022a95d2021719fd6988057630ab903d6032029095cd8b4fab9318fe07f5571dc7464f128398afb22f02850b582e5e50623b1f84e

Download Submit
memory/268-139-0x0000000000000000-mapping.dmp

Download
memory/1652-135-0x0000000000000000-mapping.dmp

Download
memory/3508-132-0x0000000000000000-mapping.dmp

Download
memory/4880-138-0x0000000000000000-mapping.dmp

Download