Overview

overview

10

Static

static

3

85edef24a6...JC.exe

windows7-x64

10

85edef24a6...JC.exe

windows10-2004-x64

10

Resubmissions

14-10-2023 23:00

231014-2y4mkscd2y 10

14-10-2023 22:58

231014-2xw64seb43 10

14-10-2023 04:03

231014-emwfhaff5x 10

Analysis

  • max time kernel
    50s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2023 22:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe

  • Size

    2.8MB

  • MD5

    723a599e70812b9aa02beb8ba5ecd258

  • SHA1

    25b72aa419fca1ecb094e65215fbc34bcf3566c8

  • SHA256

    85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6

  • SHA512

    d73768a8f43d4707fdf6e329d0a58bd15b144916db6509b48ccde0ac075bdccdade1cca369c0123a1e1edd9f7b71be5d893462875685ddf8347014ce48b59c10

  • SSDEEP

    49152:jCfDVSuEDBxOGNDHw3eO/t578Or4loBkGIEQoPYk41Rwr/WRnqmU0wYF:eb0fZC3eO/t3r4loB2oPewzWqT0wYF

Score
10/10
lucastealerstealer

Malware Config

Extracted

Family

lucastealer

C2

https://api.telegram.org/bot6144496200:AAG-IIb4TPBPT1INBnZWa7iLZBVaG67I2mE

Signatures

  • Luca Stealer

    Info stealer written in Rust first seen in July 2022.

    stealerlucastealer
  • Luca Stealer payload 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\85edef24a66c5400325643150da1de646996947cbff6f3fada987867a70655d6_JC.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2160
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2160-0-0x0000000140000000-0x00000001406EB000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2160-1-0x00007FFB860B0000-0x00007FFB860B2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2160-2-0x0000000140000000-0x00000001406EB000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2160-6-0x0000000140000000-0x00000001406EB000-memory.dmp

    Filesize

    6.9MB

    Download