Analysis Overview
SHA256
ff9c2ad53217ff19274a9e34a74357102890857ce698a5c66c3cce2d0cc6cd23
Threat Level: Known bad
The file 989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.zip was found to be: Known bad.
Malicious Activity Summary
Luca Stealer payload
Lucastealer family
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Unsigned PE
Command and Scripting Interpreter: PowerShell
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-12-27 20:48
Signatures
Luca Stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Lucastealer family
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-12-27 20:48
Reported
2024-12-27 20:51
Platform
win7-20240903-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Processes
C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe
"C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe"
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2024-12-27 20:48
Reported
2024-12-27 20:51
Platform
win10v2004-20241007-en
Max time kernel
94s
Max time network
150s
Command Line
Signatures
Reads user/profile data of web browsers
Unsecured Credentials: Credentials In Files
Accesses cryptocurrency files/wallets, possible credential harvesting
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4748 wrote to memory of 1776 | N/A | C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 4748 wrote to memory of 1776 | N/A | C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe
"C:\Users\Admin\AppData\Local\Temp\989af492fa898868e67636bf47e06a7c5864f31849fc3b3a07b07e7a3a62d944.exe"
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "Get-Culture | Select -ExpandProperty DisplayName"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | ipwho.is | udp |
| DE | 195.201.57.90:443 | ipwho.is | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.telegram.org | udp |
| US | 8.8.8.8:53 | 90.57.201.195.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.210.23.2.in-addr.arpa | udp |
| NL | 149.154.167.220:443 | api.telegram.org | tcp |
| US | 8.8.8.8:53 | 220.167.154.149.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 2.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 200.163.202.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/1776-0-0x00007FF8A8573000-0x00007FF8A8575000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fpmohr3v.cxm.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1776-10-0x00000266E16C0000-0x00000266E16E2000-memory.dmp
memory/1776-11-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp
memory/1776-12-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp
memory/1776-16-0x00007FF8A8570000-0x00007FF8A9031000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\browser_network_cookies
| MD5 | 1204cf7b056c94ecb3a77ad8d82b11ee |
| SHA1 | 8c4a07ac980068bb2716f73d7d672fe74c13dd6e |
| SHA256 | 4637968fb88170f35a7c3310e529613a47d27d3620e7bd58ee0579e8613cc79a |
| SHA512 | 0cd417213c75b500e9e1e28edf27225e8f70fd5ab17c3885e6ea719a227bbcab5b9e5be3fb96e341308163282603d1080c97e848642d9a7cf4983bf0bdc07fe0 |
C:\Users\Admin\AppData\Local\Temp\browser_default_login_data
| MD5 | a182561a527f929489bf4b8f74f65cd7 |
| SHA1 | 8cd6866594759711ea1836e86a5b7ca64ee8911f |
| SHA256 | 42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914 |
| SHA512 | 9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558 |
C:\Users\Admin\AppData\Local\Temp\browser_default_webdata
| MD5 | a1eeb9d95adbb08fa316226b55e4f278 |
| SHA1 | b36e8529ac3f2907750b4fea7037b147fe1061a6 |
| SHA256 | 2281f98b872ab5ad2d83a055f3802cbac4839f96584d27ea1fc3060428760ba7 |
| SHA512 | f26de5333cf4eaa19deb836db18a4303a8897bf88bf98bb78c6a6800badbaa7ab6aeb6444bbbe0e972a5332670bdbb474565da351f3b912449917be21af0afb8 |
C:\Users\Admin\AppData\Local\Temp\opera gx stable_default_login_data
| MD5 | 349e6eb110e34a08924d92f6b334801d |
| SHA1 | bdfb289daff51890cc71697b6322aa4b35ec9169 |
| SHA256 | c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a |
| SHA512 | 2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574 |
C:\Users\Admin\AppData\Local\Temp\zntgzRYQ5tDUxmHE6STCgDU2j7P28C\sensfiles.zip
| MD5 | 1d1b2d15917044730d31b2f1e1d53ce9 |
| SHA1 | 18167d00731dc2547a4695974a2db81457ce9cf7 |
| SHA256 | 7e31770ce33d728f796bbc629f83dff031e5e851556b941efa31b05566fa9624 |
| SHA512 | 152cc410a3fbf3f7d5ec8c44a7c098b3731fd110510e05b9260f1d4346ecae1522fbbfe5fe1ab5942e5e9c6a2d6a8c60f44a0ee1b8a81b5198a871f4d30f722a |