lucastealer | 8acf346f8e6cc412c42bcf827a01fc8b22ce643aa8088f025e2320c43c145f28

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2023 16:56

Target

e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe
Size

3.6MB
MD5

6ea2e54163f59cc8a7b73e38cce87071
SHA1

6a92ebd7713ce02161da0fced34581c0d3921ab4
SHA256

e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda
SHA512

639482bdd1b21f3b1ea42dd6d53e5552af1d5a4bd94e5b110e4cb0b5fcab8675b04ed1ed00dac4f6a0f4295e2396cd3976031c6adb4d9b5e075d5bae253d0846
SSDEEP

49152:NTOx9LzpCkE4m85goOiG73wv6R8fKHIOC5ATFru2+Jm+4s2AfBJk/xoIHZqgKMHg:dFGAjpo12bZKMuk

Score

10^/10

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

23 ip-api.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3432 2752 WerFault.exe e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe

flow	ioc
23	ip-api.com

pid	pid_target	process	target process
3432	2752	WerFault.exe	e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe

pid	process
2752	e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe
2752	e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe
2752	e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe
2752	e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe

C:\Users\Admin\AppData\Local\Temp\e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe
"C:\Users\Admin\AppData\Local\Temp\e7e1825173152caddc73e659c39b956f666f4348e7163be34fc9b3eb14ffdbda.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2752 -s 1584
  2⤵
  - Program crash
  PID:3432

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 460 -p 2752 -ip 2752
1⤵
PID:64

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\sensfiles.zip

Filesize
550KB

MD5
75cebe4305a9940cb8f7c66cb6ef5a03

SHA1
334dd9d81332fd8c0fe704176a558af185b2c5df

SHA256
f95fa50945471741807ce2a7ed598245ab8cfd44f548a2f8c8f247f62138b2bc

SHA512
6bfa7e61058fa55bcb7502877d3aa850f454fe31e82738e9c6a37720c081474438041cbac4d5e3c816abe25a1861fc3625ad27f37df7f4f4d3a73eae7149eb75

Download Submit