C:\BUILD\work\e0dd9643#qEv3wLl*3(>MpgM
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-23_1b46d77faf5e28b73a54fbb8623968d1_luca-stealer_magniber.exe
Resource
win7-20241023-en
General
-
Target
2024-12-23_1b46d77faf5e28b73a54fbb8623968d1_luca-stealer_magniber
-
Size
4.9MB
-
MD5
1b46d77faf5e28b73a54fbb8623968d1
-
SHA1
466b490653adde204527af534c140444fd078f7e
-
SHA256
a75197137718a7ab7e63ed48f1ffae611768ad3c9a9babc65165ac5ec1131b4e
-
SHA512
ae4e13cded9cfa7747b250e1ecb974b2099a333f831ecba30cf52ff3a67e412f2e8487ac7c7feeb0f1c970bc83b216cf398a375cdf3c962117ee5fca879a26a6
-
SSDEEP
98304:TikqNYWjk6M3DfOzcO4sCsvgbBU54zCXBOooIk+JAj:TiTNjk6M3zOAOTxI8mCR4/L
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-12-23_1b46d77faf5e28b73a54fbb8623968d1_luca-stealer_magniber
Files
-
2024-12-23_1b46d77faf5e28b73a54fbb8623968d1_luca-stealer_magniber.exe windows:6 windows x86 arch:x86
ac93ca31b4d146725bc43d207826b84d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
rpcrt4
RpcMgmtEpEltInqNextW
I_RpcBindingInqLocalClientPID
RpcRevertToSelf
RpcImpersonateClient
RpcServerUnregisterIfEx
RpcServerRegisterIf2
RpcObjectSetType
RpcServerUseProtseqEpW
RpcEpRegisterW
RpcEpUnregister
RpcIfInqId
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
RpcAsyncCancelCall
NdrAsyncClientCall
NdrServerCall2
NdrAsyncServerCall
UuidToStringW
UuidFromStringW
RpcStringBindingParseW
RpcSsDestroyClientContext
RpcMgmtEpEltInqDone
RpcBindingFree
NdrClientCall2
RpcStringFreeW
RpcBindingFromStringBindingW
RpcStringBindingComposeW
RpcMgmtEpEltInqBegin
RpcBindingToStringBindingW
UuidCreate
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
shell32
ord165
SHGetFolderPathW
ntdll
NtQueryInformationWorkerFactory
NtQuerySystemInformation
NtQueryInformationProcess
NtCreateWorkerFactory
NtClose
NtSetInformationThread
VerSetConditionMask
RtlDllShutdownInProgress
NtDeleteKey
RtlUnwind
RtlNtStatusToDosError
NtOpenKey
RtlCaptureContext
NtSystemDebugControl
NtQueryKey
ole32
OleUninitialize
CoCreateGuid
OleInitialize
advapi32
RegQueryMultipleValuesW
RegDeleteTreeW
RegNotifyChangeKeyValue
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
FreeSid
RegOpenKeyExW
RevertToSelf
AddAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegCloseKey
OpenThreadToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ImpersonateSelf
AdjustTokenPrivileges
GetTokenInformation
OpenProcessToken
EqualSid
LookupPrivilegeValueW
DuplicateToken
CheckTokenMembership
user32
PeekMessageW
RegisterClassExW
GetClassInfoExW
SetWindowLongW
SendMessageW
PostMessageW
RegisterWindowMessageW
IsHungAppWindow
LoadStringW
GetSystemMetrics
GetGUIThreadInfo
SendMessageCallbackW
kernel32
GetLocaleInfoEx
SleepConditionVariableSRW
WakeAllConditionVariable
EncodePointer
LCMapStringEx
GetCPInfo
IsProcessorFeaturePresent
InitializeSListHead
UnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
OutputDebugStringW
InterlockedPushEntrySList
ExitThread
FreeLibraryAndExitThread
GetStdHandle
ExitProcess
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
InitOnceComplete
GetConsoleOutputCP
GetConsoleMode
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
ReadConsoleW
WriteConsoleW
FindResourceExW
RegisterWaitForSingleObject
InitOnceBeginInitialize
AcquireSRWLockShared
ReleaseSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WakeConditionVariable
WideCharToMultiByte
MultiByteToWideChar
CreateFileW
LoadLibraryExW
CloseHandle
GetLastError
GetProcAddress
GetModuleHandleW
FreeLibrary
GetProcessHeap
SetDllDirectoryW
GetCommandLineW
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleExW
GetCurrentThreadId
HeapAlloc
HeapFree
GetProcessId
GetCurrentProcess
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateThread
GetSystemDirectoryW
LoadLibraryW
GetFileAttributesW
GetModuleFileNameW
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
VerifyVersionInfoW
FindFirstFileW
DeleteFileW
ReadProcessMemory
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
GetSystemTimeAsFileTime
Sleep
SetEvent
SetErrorMode
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
VirtualQuery
VirtualProtect
GetTickCount
CreateEventW
QueryFullProcessImageNameW
GetPriorityClass
OpenThread
GetThreadPriority
K32EnumProcesses
OpenProcess
GetThreadTimes
K32GetProcessMemoryInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProcessHandleCount
RaiseException
CreateIoCompletionPort
CheckRemoteDebuggerPresent
FlushInstructionCache
DeviceIoControl
TerminateProcess
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
SetLastError
GetNativeSystemInfo
DuplicateHandle
GetSystemTimes
GetProcessTimes
InitializeCriticalSectionEx
HeapSize
HeapReAlloc
DecodePointer
HeapDestroy
GetFileTime
CompareFileTime
SetFilePointerEx
UnlockFileEx
LockFileEx
GetFileSizeEx
ReadFile
QueryUnbiasedInterruptTime
CancelIoEx
GetOverlappedResult
ResetEvent
ReadDirectoryChangesW
UnregisterWaitEx
ProcessIdToSessionId
WaitForMultipleObjects
GetCurrentThread
GetVersion
LocalFree
TerminateThread
ResumeThread
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
GetThreadId
WriteFile
FlushFileBuffers
GetFileInformationByHandle
GetFullPathNameW
OutputDebugStringA
FileTimeToSystemTime
CreateDirectoryW
FindNextFileW
ExpandEnvironmentStringsW
SetFileAttributesW
SetFileInformationByHandle
MoveFileExW
GetFileAttributesExW
SetEndOfFile
SetFilePointer
FindFirstFileExW
GetDriveTypeW
GetDiskFreeSpaceExW
FindResourceW
LoadResource
LockResource
SizeofResource
K32GetMappedFileNameW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
FindFirstVolumeW
QueryDosDeviceW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
FindVolumeClose
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GlobalMemoryStatusEx
CompareStringW
SetThreadpoolWait
CreateThreadpoolWait
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
GetTickCount64
GetSystemInfo
GetVersionExW
GetProcessAffinityMask
GetLongPathNameW
VirtualAlloc
VirtualFree
GetExitCodeThread
GetFileSize
SetFileTime
WaitForSingleObjectEx
FormatMessageA
GetFileInformationByHandleEx
AreFileApisANSI
GetStringTypeW
FindClose
InitializeCriticalSectionAndSpinCount
powrprof
CallNtPowerInformation
shlwapi
PathAppendW
Exports
Exports
asw_process_storage_allocate_connector
asw_process_storage_deallocate_connector
on_avast_dll_unload
onexit_register_connector_avast_2
Sections
.text Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 742KB - Virtual size: 741KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 406KB - Virtual size: 436KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ