051713e072d57ebec4c9a59b643a6516241857a3031b18e26dc012ca435378f8 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
15-12-2024 12:44

Sharing

Report Analysis Logs

General

Target

2024-12-15_5d4f39374f85916a209fa6ea2d92aded_frostygoop_luca-stealer_snatch.exe
Size

13.7MB
MD5

5d4f39374f85916a209fa6ea2d92aded
SHA1

161056f2e481cae59e3366c63f4e8b61805ba3d4
SHA256

051713e072d57ebec4c9a59b643a6516241857a3031b18e26dc012ca435378f8
SHA512

7c5b98076d2a43b9964cee7cbd779a19875eb0a266435a2e141ff1fc2fe69ae446fe9f8a55e0ec6bac43c422f344d6367b4ac78f0a888e394e9b86078f076c83
SSDEEP

98304:hl9c46VWsAojvyKLBq2G0RHruuR/jr08lKlBfk9Va86vVULwD5FRF6/OL2C1MfeG:yFHKGUjfk9VcvbqOL2CO242Od7Om

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

C:\Users\Admin\AppData\Local\Temp\2024-12-15_5d4f39374f85916a209fa6ea2d92aded_frostygoop_luca-stealer_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2024-12-15_5d4f39374f85916a209fa6ea2d92aded_frostygoop_luca-stealer_snatch.exe"
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Session Storage_8.temp\CURRENT.bak

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit