lucastealer | 41554c195bc8c87ddb8bbeacefe77c033f56549a03361dd76c2243546dd1f2d8

Resubmissions

02-11-2023 21:08

231102-zy2f4shf43 10

02-11-2023 19:29

231102-x7fjwsec8w 10

30-06-2023 11:57

230630-n4mdlaae31 7

Analysis

max time kernel
312s
max time network
324s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
02-11-2023 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

payload.exe
Size

9.0MB
MD5

f6c5df8944a965d0d3aa2e124a1935af
SHA1

3ff36a13827d193a85eed40b59646bad1d676986
SHA256

41554c195bc8c87ddb8bbeacefe77c033f56549a03361dd76c2243546dd1f2d8
SHA512

8d75df03c33e9288b2d4b9e941c89ca2e0e7008e151ee3c104292427266043050f9966d0ff6e5c46890bde404337873768a4cde255778418144766646d08ceae
SSDEEP

196608:cTEcVnJULKrytYcJX7Nfjw9cI1qyz+6weSn5NeCX4X6:4EcVnukcJLtlIwqwemrePX6

Score

10^/10

lucastealer spyware stealer

Malware Config

Extracted

Family

lucastealer

https://api.telegram.org/bot5749635914:AAHO1FmA3UVCNqptBOADqQF-cFGUoMOYe6g

Signatures

Luca Stealer
Info stealer written in Rust first seen in July 2022.
stealer lucastealer

Luca Stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4832-1-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp	family_lucastealer
behavioral2/memory/4832-2-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp	family_lucastealer
behavioral2/memory/4832-189-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp	family_lucastealer
behavioral2/memory/4832-191-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp	family_lucastealer

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
4832	payload.exe
4832	payload.exe
2068	powershell.exe
2068	powershell.exe
2068	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 2068	4832	payload.exe	72
PID 4832 wrote to memory of 2068	4832	payload.exe	72

C:\Users\Admin\AppData\Local\Temp\payload.exe
"C:\Users\Admin\AppData\Local\Temp\payload.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gtjmftmg.43h.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bravesoftware_default_login_data

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\bravesoftware_default_webdata

Filesize
92KB

MD5
843933002e97a0ed13a5842ff69162e7

SHA1
78c28c8cf61ad98c9dce2855d27af25c2cb0254c

SHA256
1976c8cf1ab2fd32680f25be2b7b5d7c8ae5780948024cafbbdde28e25cdf31c

SHA512
77c82c3cc8dc7dccb2e59670b35539fda008ed002624125126558116697f07862cdce4489e581b6a2bf5e61bc5f0fd93d8adcd2370556dd053649c4ab2b0ebdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bravesoftware_network_cookies

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\o7edyzCZ3t1CumEjnWGifFoGDajiHU\sensfiles.zip

Filesize
6.3MB

MD5
a8cd0cd5494ee3f38eb3d95a083945c8

SHA1
48fbd84866607d793d1cad4c3b3ef68d070186d7

SHA256
c1242c631e934df8a4f263f1f5fa23b31269720740c57bc9a35a174077470482

SHA512
265f6462d274574f759fef7587c110675f01d5519d20cc2f1dc89d95c1a10321fd1f3e13939869564d2dabc94e0f6593684ced965475e27b381d509a8e5eb772

Download Submit
memory/2068-36-0x00007FFA942D0000-0x00007FFA94CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2068-13-0x0000016377530000-0x0000016377540000-memory.dmp

Filesize
64KB

Download
memory/2068-16-0x00000163776C0000-0x0000016377736000-memory.dmp

Filesize
472KB

Download
memory/2068-10-0x0000016376EF0000-0x0000016376F12000-memory.dmp

Filesize
136KB

Download
memory/2068-35-0x0000016377530000-0x0000016377540000-memory.dmp

Filesize
64KB

Download
memory/2068-11-0x00007FFA942D0000-0x00007FFA94CBC000-memory.dmp

Filesize
9.9MB

Download
memory/2068-12-0x0000016377530000-0x0000016377540000-memory.dmp

Filesize
64KB

Download
memory/4832-2-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp

Filesize
16.6MB

Download
memory/4832-0-0x00007FFAB13D0000-0x00007FFAB13D2000-memory.dmp

Filesize
8KB

Download
memory/4832-1-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp

Filesize
16.6MB

Download
memory/4832-189-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp

Filesize
16.6MB

Download
memory/4832-191-0x00007FF683EE0000-0x00007FF684F77000-memory.dmp

Filesize
16.6MB

Download