Overview

overview

10

Static

static

3

001.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    001.exe

  • Size

    6.9MB

  • Sample

    241110-xbc4wswjen

  • MD5

    1632b97230c6d7dbc1f4ace409e92ba1

  • SHA1

    c884ed2837673b90e1fba77f9b04c8d2e3c1927d

  • SHA256

    cca2f9105b2a1998eadcc8cabe7e18704f2c7de1e2c5b03e6a7f652082b81510

  • SHA512

    99aa5818fe08ea5717b62108e5c95ddbdca6f31f39e26695ca6079ca7d64b2fe70643a36b72f796e6e3d361da3d92d4764b5b16b5bfb65165354c5e6b3651e8e

  • SSDEEP

    196608:d0smbmVIlqWrGTrwW/0dy/SLSJS5wS/H08SWoDpGI:SBbOIlkWcUI

Score
10/10
lucastealercredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Family

lucastealer

C2

https://api.telegram.org/bot5504089027:AAFZwWvljkPTGD18o3BaTdJaHkFe-rjBlHk

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RESTORE-MY-FILES.txt

Ransom Note
***SOLIDBIT RANSOMWARE*** All of your files are encrypted by SOLIDBIT ransomware and you cannot decrypt it without our help. If you try to use any additional recovery software - the files might be damaged, so if you are willing to try - try it on the data of the lowest value. To make sure that we REALLY CAN recover data - we offer you to decrypt samples. You can recover all your files safely and easily with us. Contact Download Tor Browser - https://www.torproject.org/download/ and install it Open the link below in Tor Browser and follow instructions on this page http://solidb2jco63vbhx4sfimnqmwhtdjk4jbbgq7a24cmzzkfse4rduxgid.onion Decryption ID: 5-112WSBDJF5NYZAIO5L4XBTWGTRKXk8
URLs

http://solidb2jco63vbhx4sfimnqmwhtdjk4jbbgq7a24cmzzkfse4rduxgid.onion

Targets

    • Target

      001.exe

    • Size

      6.9MB

    • MD5

      1632b97230c6d7dbc1f4ace409e92ba1

    • SHA1

      c884ed2837673b90e1fba77f9b04c8d2e3c1927d

    • SHA256

      cca2f9105b2a1998eadcc8cabe7e18704f2c7de1e2c5b03e6a7f652082b81510

    • SHA512

      99aa5818fe08ea5717b62108e5c95ddbdca6f31f39e26695ca6079ca7d64b2fe70643a36b72f796e6e3d361da3d92d4764b5b16b5bfb65165354c5e6b3651e8e

    • SSDEEP

      196608:d0smbmVIlqWrGTrwW/0dy/SLSJS5wS/H08SWoDpGI:SBbOIlkWcUI

    Score
    10/10
    lucastealercredential_accessdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

    • Luca Stealer

      Info stealer written in Rust first seen in July 2022.

      stealerlucastealer

    • Lucastealer family

      lucastealer

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Renames multiple (202) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Sets desktop wallpaper using registry

      ransomware

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

Windows Management Instrumentation

1
T1047

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Direct Volume Access

1
T1006

Indicator Removal

3
T1070

File Deletion

3
T1070.004

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Inhibit System Recovery

4
T1490

Tasks