Analysis
-
max time kernel
86s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-02-2024 08:54
General
-
Target
xone.crack.exe
-
Size
4.3MB
-
MD5
d8ce4ef56ff10aa1a9625d76509993bc
-
SHA1
a032f36290695d1f8f744d188d025993d62b1dab
-
SHA256
ab714198bd03a5b9577fe4f974f08eb8bc4d63de51ace8964f2dbc279c1c2f86
-
SHA512
84f2f1e205f90b2c48304481f300c7dd171a59f9f2fdbae00279578aae2164e0db162c78d75024779064728f47e98de49a67a9d6b5b14e80f1d650b8c11d9e83
-
SSDEEP
49152:XJzG4XQxvHUmPbLHzDJLwvGEzgFuDOkWHYgEETBLunBwHAN5CHhCwoqmDuxZs8Dz:RkvHUmv1+Ge0Yh4voqmDu0WxcyRZmH
Score
10/10
Malware Config
Signatures
-
Luca Stealer
Info stealer written in Rust first seen in July 2022.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\xone.crack.exe"C:\Users\Admin\AppData\Local\Temp\xone.crack.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses