Analysis

  • max time kernel
    69s
  • max time network
    179s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25-02-2023 22:26

General

  • Target

    319157bf510e966d20d5129f1966ece7cb18c2d3d781a31a95f0af3be5926749.exe

  • Size

    5.7MB

  • MD5

    deb9c6e9c058071ebf52521065a75018

  • SHA1

    d3f54b15504de1a55d26a5753f1254c5c42fadec

  • SHA256

    319157bf510e966d20d5129f1966ece7cb18c2d3d781a31a95f0af3be5926749

  • SHA512

    404d63f29db4b8edf4f5b73442e8e0c4dd58829b57bd2a75149d07acbd105cc9958429231f7f42dfb514824b62c7990d03913fbfd54d2e16273fd406e380be37

  • SSDEEP

    49152:7Zg+YZ4PyxV4maKAUerq93kBis7q9mMts5lfarmNP78xMng+HEvLV+io6B5i5lSy:fFsaAnc6ZcIUk+r

Malware Config

Signatures

  • Luca Stealer

    Info stealer written in Rust first seen in July 2022.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\319157bf510e966d20d5129f1966ece7cb18c2d3d781a31a95f0af3be5926749.exe
    "C:\Users\Admin\AppData\Local\Temp\319157bf510e966d20d5129f1966ece7cb18c2d3d781a31a95f0af3be5926749.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    PID:4188
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4188 -s 1460
      2⤵
      • Program crash
      PID:1988

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\logscx\sensfiles.zip

    Filesize

    1.8MB

    MD5

    bcde31d41e26a57b060f97f1092bad6d

    SHA1

    122845bf27202176afbdfe6cd063458cad3f6b88

    SHA256

    820002481bcec1f6cf0d101a36613dea6074b7860f01c00e09dd53f0f9120531

    SHA512

    70373859ecb4e03206c8aa0ee688a46656589760147eed2281198a8ad113a555f2a5505012e74accb15c3207880ffa0e9245e9c6f173c81918e7f5b77d980225