Analysis
-
max time kernel
51s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
25-03-2023 18:03
General
-
Target
Remcos Professional.exe
-
Size
6.5MB
-
MD5
1ecae7b88236fff686604c40f2ec8ef0
-
SHA1
5338d387c764b7da0a097e4dd38c17c603e62b08
-
SHA256
95a3f82e8e77aeb491d7faaf17c4f206763ff7eb08b8696e28ad109b67b984cf
-
SHA512
6a396bf98181250a2a386c2ee4dbcd8a4be6e23de029d614296e6f33a66b6f6049b487ef07d70936812c31f6cce7bb1b709361b749e0b1ad3507382b26c00a5c
-
SSDEEP
196608:CyDxS34Qskc93Uuze5VbN0Wp4ctz7Z9aVi:txb1kcWuzku84cNd
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Luca Stealer payload 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Remcos Professional.exe"C:\Users\Admin\AppData\Local\Temp\Remcos Professional.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD55a42dfed0ee0a648bf3fc2fc21e350e9
SHA16f72e4cc0d19c0a9f33d3d011adfd1b702355bdd
SHA256b20a4d8d8753d694e77ee10b9f6fb13e99cdec595dc2a8e3e538f4c018dc3d4a
SHA512343d7ac3d4eca47aef8b9402541d05f569f10577e518a35246bb23f54b8e523f1eb53b900430c0a3f4b64a8f43ec53da821c355921f1fd8237a075b0705b5d4a
-
Filesize
25.3MB
-
Filesize
25.3MB
-
Filesize
25.3MB