Analysis Overview
SHA256
989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944
Threat Level: Known bad
The file Flasher.exe was found to be: Known bad.
Malicious Activity Summary
Luca Stealer payload
Lucastealer family
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Unsigned PE
Command and Scripting Interpreter: PowerShell
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-27 20:32
Signatures
Luca Stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Lucastealer family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-27 20:32
Reported
2024-12-27 20:35
Platform
win7-20241023-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\Flasher.exe
"C:\Users\Admin\AppData\Local\Temp\Flasher.exe"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-27 20:32
Reported
2024-12-27 20:35
Platform
win10v2004-20241007-en
Max time kernel
94s
Max time network
150s
Command Line
Signatures
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3528 wrote to memory of 1636 | N/A | C:\Users\Admin\AppData\Local\Temp\Flasher.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 3528 wrote to memory of 1636 | N/A | C:\Users\Admin\AppData\Local\Temp\Flasher.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\Flasher.exe
"C:\Users\Admin\AppData\Local\Temp\Flasher.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ipwho.is | udp |
| DE | 195.201.57.90:443 | ipwho.is | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 90.57.201.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 149.220.183.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 53.210.109.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 22.49.80.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 73.144.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
Files
memory/1636-0-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mpohhbk0.dzm.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1636-9-0x0000020AA81D0000-0x0000020AA81F2000-memory.dmp
memory/1636-11-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp
memory/1636-12-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp
memory/1636-16-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\chromium_default_webdata
| MD5 | a1eeb9d95adbb08fa316226b55e4f278 |
| SHA1 | b36e8529ac3f2907750b4fea7037b147fe1061a6 |
| SHA256 | 2281f98b872ab5ad2d83a055f3802cbac4839f96584d27ea1fc3060428760ba7 |
| SHA512 | f26de5333cf4eaa19deb836db18a4303a8897bf88bf98bb78c6a6800badbaa7ab6aeb6444bbbe0e972a5332670bdbb474565da351f3b912449917be21af0afb8 |
C:\Users\Admin\AppData\Local\Temp\chromium_network_cookies
| MD5 | 1204cf7b056c94ecb3a77ad8d82b11ee |
| SHA1 | 8c4a07ac980068bb2716f73d7d672fe74c13dd6e |
| SHA256 | 4637968fb88170f35a7c3310e529613a47d27d3620e7bd58ee0579e8613cc79a |
| SHA512 | 0cd417213c75b500e9e1e28edf27225e8f70fd5ab17c3885e6ea719a227bbcab5b9e5be3fb96e341308163282603d1080c97e848642d9a7cf4983bf0bdc07fe0 |
C:\Users\Admin\AppData\Local\Temp\chromium_default_login_data
| MD5 | a182561a527f929489bf4b8f74f65cd7 |
| SHA1 | 8cd6866594759711ea1836e86a5b7ca64ee8911f |
| SHA256 | 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914 |
| SHA512 | 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558 |
C:\Users\Admin\AppData\Local\Temp\bravesoftware_default_login_data
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\yPXETKzDUCOwFbUBXyPhB98Gdprl9h\sensfiles.zip
| MD5 | 5da9bde7207f7e9471a1ab65d1dd7e89 |
| SHA1 | 1c340e1de413e28e410f0d5283f9490d614f625a |
| SHA256 | 1a3fd59b427ed1cdf3adaca5449178a1aab7ffe199dd72ffb52c3a205e2f16ba |
| SHA512 | c6eb9447870e723522b2b0e47caad81755edbef76c231e32c89390787cb44691e2f627a70ef2eacbf6c415f96f09a6290126449547dc47960fb0e90dcc76ad12 |